pub fn warn_on_workdir_exec(workdir_exec: bool)Expand description
Warns (non-fatal, once per session) when a capsule declares
capabilities.filesystem.workdir_exec: true.
This is the one grant that trades away an enforcement property rather than widening a scope:
with the workdir’s Landlock Execute right granted, capabilities.shell.allow stops being
something the kernel can hold the capsule to — a binary it compiles, downloads or renames inside
its own workdir runs regardless. The declaration is legitimate (compile-and-run workflows need
it) and the class report already says advisory, but a class in a JSON field is easy to miss
and the reason for it is not self-evident, so it is also stated in words, once, at staging.
Shared shape with warn_on_interpreter_runtime_grants: fires before any session workdir
exists, so it goes to stderr only, not logs/bootstrap.log.