MGS2005: kernel landlock unavailable; binding-level checks only

The sandbox is in best-effort mode but the host kernel does not support the landlock LSM. magus runs every child under its binding checks and env allowlist alone.

[MGS2005] kernel landlock unavailable; children run under magus's binding checks and env allowlist only
  reason=sandbox: kernel sandbox unsupported on this host: ...

Why

The sandbox enforces one policy through two layers:

1. Kernel layer: magus starts each child through a launcher that applies the policy's landlock ruleset to itself and then execs the command, so the child and everything it starts are confined.
2. Binding layer: magus's own fs, archive, crypto and http bindings and Buzz's own os and io check the policy before touching a path, and the exec binding checks the binary it is about to start.

When the kernel does not have landlock (macOS, Windows, Linux older than 5.13 or without the LSM enabled), only layer 2 runs. The notice is printed once, by the invocation you started; a nested magus prints nothing, since its parent already said it.

What still works

• A magusfile or spell calling those bindings is refused when it targets a path outside the allowlist or writes a control file.
• The first binary a step execs is checked against the exec allowlist.
• Env scrubbing still applies (it runs in pure Go), so secrets stay out of the child's environment.

What does not work

• Everything a subprocess does after it starts. sh, go test, npm and every other tool a spell runs read and write with the user's full authority. Running subprocesses is most of what a build does, so treat this host as having no filesystem sandbox for build steps.
• Anything in magus that reaches the filesystem without going through a checking binding. The binding layer is a set of checks written into particular bindings, not a boundary around the interpreter.

Resolution

• Run on Linux 5.13 or newer with landlock enabled (check that /sys/kernel/security/landlock exists).
• To refuse this fallback instead of accepting it, set sandbox.mode: required (or MAGUS_SANDBOX=required); magus then stops with MGS2012 on a host like this one.
• On macOS or Windows, accept the reduced enforcement knowingly, or pass --sandbox=off to run without the sandbox and without the notice. MAGUS_SANDBOX cannot do it: the variable is a floor that magus.yaml can raise and never lower.