feat: add execute and execute-file flags

[hanshal101]

Fixes #491
Closes #491

Description

This PR decouples file execution from read access within the nono sandbox to enforce a more robust least-privilege security model. Currently, granting a process permission to read a directory (via --read) inadvertently allows it to execute binaries or load shared libraries from that same path, creating a potential vector for exploitation. By introducing a dedicated AccessMode::Execute variant and corresponding --execute CLI flags, the sandbox can distinguish between data-only paths (like configuration folders) and binary-only paths (like /usr/bin), mapping these granular rights to Linux Landlock’s AccessFs::Execute and macOS Seatbelt’s file-map-executable and process-exec primitives.

Examples

hanshal101@lol:~/opsrc/nono$ cat /tmp/hello.sh 
echo "Hello"hanshal101@lol:~/opsrc/nono$ 
hanshal101@lol:~/opsrc/nono$ ./target/debug/nono run --allow /tmp -- /tmp/hello.sh 

  nono v0.26.1
  update 0.27.0 available (current: 0.26.1)
  $ cargo install nono-cli
  https://github.com/always-further/nono/releases/tag/v0.27.0

  Share /home/hanshal101/opsrc/nono with read access?
  use --allow-cwd to skip this prompt
  [y/N] y
  Capabilities:
  ────────────────────────────────────────────────────
   r+w  /tmp (dir)
    r   /home/hanshal101/opsrc/nono (dir)
       + 51 system/group paths (-v to show)
   net  outbound allowed
  ────────────────────────────────────────────────────

   kernel  Landlock V6 (File rename across directories (Refer), File truncation (Truncate), TCP network filtering, Device ioctl filtering, Process scoping)
2026-04-03T07:28:51.281856Z  INFO Landlock available (Landlock V6, features: Basic filesystem access control, File rename across directories (Refer), File truncation (Truncate), TCP network filtering, Device ioctl filtering, Process scoping)
  Applying sandbox...2026-04-03T07:28:51.282217Z  INFO Direct mode: detected Landlock V6
2026-04-03T07:28:51.282226Z  INFO Using Landlock ABI V6
 active

2026-04-03T07:28:51.282407Z  INFO Executing with strategy: Direct, threading: Strict
2026-04-03T07:28:51.282413Z  INFO Executing (direct): /tmp/hello.sh []
2026-04-03T07:28:51.282531Z ERROR Command execution failed: Permission denied (os error 13)
nono: Command execution failed: Permission denied (os error 13)
hanshal101@lol:~/opsrc/nono$ 
hanshal101@lol:~/opsrc/nono$ 
hanshal101@lol:~/opsrc/nono$ ./target/debug/nono run --allow /tmp --execute /tmp -- /tmp/hello.sh 

  nono v0.26.1
  update 0.27.0 available (current: 0.26.1)
  $ cargo install nono-cli
  https://github.com/always-further/nono/releases/tag/v0.27.0

  Share /home/hanshal101/opsrc/nono with read access?
  use --allow-cwd to skip this prompt
  [y/N] y
  Capabilities:
  ────────────────────────────────────────────────────
  r+w+e /tmp (dir)
    r   /home/hanshal101/opsrc/nono (dir)
       + 51 system/group paths (-v to show)
   net  outbound allowed
  ────────────────────────────────────────────────────

   kernel  Landlock V6 (File rename across directories (Refer), File truncation (Truncate), TCP network filtering, Device ioctl filtering, Process scoping)
2026-04-03T07:29:00.472528Z  INFO Landlock available (Landlock V6, features: Basic filesystem access control, File rename across directories (Refer), File truncation (Truncate), TCP network filtering, Device ioctl filtering, Process scoping)
  Applying sandbox...2026-04-03T07:29:00.473046Z  INFO Direct mode: detected Landlock V6
2026-04-03T07:29:00.473060Z  INFO Using Landlock ABI V6
 active

2026-04-03T07:29:00.473328Z  INFO Executing with strategy: Direct, threading: Strict
2026-04-03T07:29:00.473337Z  INFO Executing (direct): /tmp/hello.sh []
Hello

[gemini-code-assist]

Code Review

This pull request introduces explicit execution permissions across the sandbox core, CLI, and policy definitions, effectively decoupling execution rights from read access. Key updates include refined Landlock and Seatbelt profile generation, new CLI flags, and updated C bindings. Review feedback highlights an inconsistency in how CLI flags map to internal access modes and identifies logic duplication. Security concerns were raised regarding the macOS implementation, where certain modes still implicitly grant execution or mapping privileges, and a significant permission expansion in the node_runtime policy. Finally, an undocumented breaking change to the why command's argument structure was identified.

[hanshal101]

I have updated the code!

[lukehinds]

thanks @hanshal101 , I just landed the multiplexing lifecycle PR (a significant rework), my apologies this would have left you with a bit of a merge conflict to iron out - appreciate your contributions and welcome to the community !

[hanshal101]

thanks @hanshal101 , I just landed the multiplexing lifecycle PR (a significant rework), my apologies this would have left you with a bit of a merge conflict to iron out - appreciate your contributions and welcome to the community !

Cool! I'll try to update the PR and resolve the merge conflicts

[lukehinds]

are you working on this still @hanshal101 ?

[hanshal101]

are you working on this still @hanshal101 ?

Hello @lukehinds sorry for the delay, yes i am still working got some issues with merge conflicts here. Will do it soon

[hanshal101]

Hello @lukehinds lets run the CI once again!

[hanshal101]

hello @lukehinds I have rebased and resolved the changes, lets try running the CI once more!