Cargo.toml: deny unsafe code workspace-wide

We need to add a couple of exceptions in order to make ioctls.
Hopefully we can remove those and set this to forbid, but for now it's a
pretty strong statement going forward.

Signed-off-by: Allison Karlitskaya <[email protected]>

Author: allisonkarlitskaya

Cargo.toml

@@ -12,6 +12,7 @@ version = "0.2.0"
 
 [workspace.lints.rust]
 missing_debug_implementations = "deny"
+unsafe_code = "deny" # https://github.com/containers/composefs-rs/issues/123
 
 [workspace.dependencies]
 composefs = { version = "0.2.0", path = "crates/composefs", default-features = false }

crates/composefs/src/fsverity/ioctl.rs

@@ -1,3 +1,5 @@
+#![allow(unsafe_code)]
+
 use core::mem::size_of;
 
 use std::{io::Error, os::fd::AsFd};

crates/composefs/src/mountcompat.rs

@@ -166,6 +166,7 @@ mod tmpmount {
 /// Required before 6.12: erofs can't directly mount files.
 #[cfg(feature = "rhel9")]
 mod loopback {
+    #![allow(unsafe_code)]
     use std::{
         io::Result,
         os::fd::{AsFd, AsRawFd, OwnedFd},