Enforce frozen flag through landlock

Author: bjorn3

build_system/landlock.rs

@@ -40,20 +40,27 @@ pub(super) fn lock_fetch() {
         .unwrap();
 }
 
-pub(super) fn lock_build(cargo: &Path) {
+pub(super) fn lock_build(cargo: &Path, frozen: bool) {
     let abi = ABI::V4;
     let access_all = AccessFs::from_all(abi);
-    base_ruleset()
-        .add_rules(path_beneath_rules(
-            &[get_cargo_home(cargo).join("git"), get_cargo_home(cargo).join("registry")],
-            access_all,
-        ))
-        .unwrap()
+
+    let ruleset = base_ruleset()
         .add_rules(path_beneath_rules(
             &[env::current_dir().unwrap().join("build"), env::current_dir().unwrap().join("dist")],
             access_all,
         ))
-        .unwrap()
-        .restrict_self()
         .unwrap();
+
+    let ruleset = if frozen {
+        ruleset
+    } else {
+        ruleset
+            .add_rules(path_beneath_rules(
+                &[get_cargo_home(cargo).join("git"), get_cargo_home(cargo).join("registry")],
+                access_all,
+            ))
+            .unwrap()
+    };
+
+    ruleset.restrict_self().unwrap();
 }

build_system/main.rs

@@ -195,6 +195,8 @@ fn main() {
     path::RelPath::BUILD.ensure_exists(&dirs);
     path::RelPath::DIST.ensure_exists(&dirs);
 
+    landlock::lock_build(&bootstrap_host_compiler.cargo, frozen);
+
     {
         // Make sure we always explicitly specify the target dir
         let target =
@@ -204,8 +206,6 @@ fn main() {
         std::fs::File::create(target).unwrap();
     }
 
-    landlock::lock_build(&bootstrap_host_compiler.cargo);
-
     env::set_var("RUSTC", "rustc_should_be_set_explicitly");
     env::set_var("RUSTDOC", "rustdoc_should_be_set_explicitly");