v0.7.1: allow network inside the run_shell sandbox

Landlock no longer handles TCP, the Seatbelt profile drops (deny network*),
and the seccomp filter stops refusing IPv4/IPv6 sockets. Sandboxed commands
run without asking in auto mode on every backend (Low-IL no longer asks for
network commands), and connection errors are not treated as sandbox blocks.

tests/test_sandbox.c

@@ -72,7 +72,7 @@ static void test_blocked(void) {
   CHECK(cst_sandbox_blocked(c, strlen(c), 1));
   const char *d = "curl: (7) Failed to connect to example.com port 443 after 9 "
                   "ms: Could not connect to server\n";
-  CHECK(cst_sandbox_blocked(d, strlen(d), 7));
+  CHECK(!cst_sandbox_blocked(d, strlen(d), 7)); /* network is not sandboxed */
   const char *e = "Access is denied.\r\n";
   CHECK(cst_sandbox_blocked(e, strlen(e), 1));
   const char *f = "拒绝访问。\r\n";
@@ -132,7 +132,7 @@ static int run(const char *ws, const char *cmd, os_run_result_t *r) {
   return r->exit_code;
 }
 
-/* Child: enter the sandbox, then try a TCP connect to a local listener. */
+/* Child: enter the sandbox, then a TCP connect to a local listener works. */
 static void test_network(const char *ws) {
   int ls = socket(AF_INET, SOCK_STREAM, 0);
   CHECK(ls >= 0);
@@ -152,12 +152,11 @@ static void test_network(const char *ws) {
   if (pid == 0) {
     if (cst_sandbox_enter(&plan) != 0)
       _exit(3);
-    /* Landlock refuses the connect, seccomp already the socket */
     int s = socket(AF_INET, SOCK_STREAM, 0);
     if (s < 0)
-      _exit(errno == EACCES ? 0 : 2);
+      _exit(errno == EACCES ? 1 : 2);
     int rc = connect(s, (struct sockaddr *)&a, sizeof(a));
-    _exit(rc == 0 ? 1 : errno == EACCES ? 0 : 2);
+    _exit(rc == 0 ? 0 : errno == EACCES ? 1 : 2);
   }
   int st = 0;
   waitpid(pid, &st, 0);
@@ -337,11 +336,7 @@ static void test_confined(int kind) {
   CHECK(fp);
   fclose(fp);
 
-  if (kind == CST_SANDBOX_SECCOMP || cst_sandbox_landlock_abi() >= 4)
-    test_network(ws);
-  else
-    printf("test_sandbox: landlock ABI %d < 4, network rule not tested\n",
-           cst_sandbox_landlock_abi());
+  test_network(ws);
 
   snprintf(cmd, sizeof(cmd), "rm -rf '%s' '%s'", ws, out);
   CHECK(system(cmd) == 0);