Move the Linux no_new_privs, Landlock, and seccomp policy plumbing
into LibSandbox so individual services can describe the privileges they
need without copying the BPF and kernel feature detection machinery.
Keep ImageDecoder's sandbox policy service-local by composing the new
building blocks in SandboxLinux.cpp. This preserves the existing syscall
allowlist while making the policy easier to audit and reuse.
Keep the ImageDecoder sandbox available in sanitizer builds, but opt the
helper out of LeakSanitizer process-exit leak scans. LSan inspects
procfs during that scan, which conflicts with the helper filesystem
sandbox.
Skip the glibc malloc arena tweak under ASan as well, since ASan's
allocator makes mallopt(M_ARENA_MAX) fail and does not need that glibc
runtime workaround.
Treat poll like the other optional seccomp allowlist syscalls. Linux
architectures that use asm-generic syscall numbers do not define
__NR_poll, since libc implements poll through ppoll there.
Only allow raw clone when the flags match pthread-style thread creation,
and return ENOSYS for clone3 so libc falls back to clone without giving
the sandbox an opaque process-creation syscall.
Drop the 32-bit audit architecture cases from the Linux sandbox while
here, since Ladybird does not support 32-bit systems and those paths
would need extra syscall variants.
Add --enable-sandbox to Ladybird and test-web, pass it through to
ImageDecoder, and make ImageDecoder install its Linux sandbox only when
the option is present.
The Linux implementation enables no_new_privs, configures glibc malloc
to avoid late CPU-count probes in helper threads, applies an empty
Landlock ruleset when available, and installs a seccomp filter for the
helper IPC, shared memory, threading, and decoding syscalls.
Deny plain read-only filesystem probes without granting file access, so
common runtime feature checks can observe the sandbox instead of
terminating the helper during normal decoding.
