Repository: hashicorp/nomad
File: client/allocrunner/taskrunner/getter/util_linux.go (Go)

Code before:
	return landlock.Available()
}

// lockdown isolates this process to only be able to write and
// create files in the task's task directory.
// dir - the task directory
//
// Only applies to Linux, when available.
func lockdown(allocDir, taskDir string, extra []string) error {
	// landlock not present in the kernel, do not sandbox
	if !landlock.Available() {
		return nil
	}
	paths := []*landlock.Path{
		landlock.DNS(),
		landlock.Certs(),
		landlock.Shared(),
		landlock.Dir(allocDir, "rwc"),
		landlock.Dir(taskDir, "rwc"),
	}

	// Add the initial directories, checking for existence
	// prior to adding them.
	for p, mode := range initialDirs {
		_, err := os.Stat(p)
		if err == nil {
			paths = append(paths, landlock.Dir(p, mode))
		}
	}

	for _, p := range extra {
		path, err := landlock.ParsePath(p)
		if err != nil {
			return err
		}
		paths = append(paths, path)
	}
	paths = append(paths, additionalFilesForVCS()...)
	locker := landlock.New(paths...)
	return locker.Lock(landlock.Mandatory)
}

func additionalFilesForVCS() []*landlock.Path {
	const (
		homeSSHDir     = ".ssh"                     // git ssh
		homeKnownHosts = ".ssh/known_hosts"         // git ssh
		etcPasswd      = "/etc/passwd"              // git ssh
		etcKnownHosts  = "/etc/ssh/ssh_known_hosts" // git ssh
		gitGlobalFile  = "/etc/gitconfig"           // https://git-scm.com/docs/git-config#SCOPES
		hgGlobalFile   = "/etc/mercurial/hgrc"      // https://www.mercurial-scm.org/doc/hgrc.5.html#files
		hgGlobalDir    = "/etc/mercurial/hgrc.d"    // https://www.mercurial-scm.org/doc/hgrc.5.html#files

Review comment (suggestion):
strictly speaking, it's not only checking existence. I suspect we do want to skip adding ones that produce an error of any kind (https://pkg.go.dev/os#pkg-variables) as you do here, but the comment is a tad misleading.

Code after:
// the current platform.
func lockdownAvailable() bool {
	return landlock.Available()
}

// lockdown isolates this process to only be able to write and
// create files in the task's task directory.
// dir - the task directory
//
// Only applies to Linux, when available.
func lockdown(l log.Logger, allocDir, taskDir string, extra []string) error {
	// landlock not present in the kernel, do not sandbox
	if !landlock.Available() {
		return nil
	}
	paths := []*landlock.Path{
		landlock.DNS(),
		landlock.Certs(),
		landlock.Shared(),
		landlock.Dir(allocDir, "rwc"),
		landlock.Dir(taskDir, "rwc"),
	}

	// Add the initial directories
	for p, mode := range initialDirs {
		_, err := os.Stat(p)
		if err != nil {
			if errors.Is(err, os.ErrNotExist) {
				// paths that do not exist are skipped
				l.Debug("landlock is skipping path that does not exist", "path", p)
			} else {
				// other errors should be logged to provide context on why
				// the path is not included
				l.Warn("landlock setup failed to stat path, skipping", "path", p, "error", err)
			}

			continue
		}
		paths = append(paths, landlock.Dir(p, mode))
	}

	for _, p := range extra {
		path, err := landlock.ParsePath(p)
		if err != nil {
			return err
		}
		paths = append(paths, path)
	}
	paths = append(paths, additionalFilesForVCS()...)
	locker := landlock.New(paths...)
	return locker.Lock(landlock.Mandatory)