vmm: Enable Landlock on vmm thread

Add file/dir paths from landlock-rules arguments to ruleset. Invoke
apply_landlock on VmConfig to apply config specific rules to ruleset.

Once done, any threads spawned by vmm thread will be automatically
sandboxed with the ruleset in vmm thread.

Signed-off-by: Praveen K Paladugu <prapal@linux.microsoft.com>

vmm/src/vm.rs

@@ -28,6 +28,7 @@ use crate::device_tree::DeviceTree;
 use crate::gdb::{Debuggable, DebuggableError, GdbRequestPayload, GdbResponsePayload};
 #[cfg(feature = "igvm")]
 use crate::igvm::igvm_loader;
+use crate::landlock::LandlockError;
 use crate::memory_manager::{
     Error as MemoryManagerError, MemoryManager, MemoryManagerSnapshotData,
 };
@@ -122,6 +123,9 @@ pub enum Error {
     #[error("Cannot load the kernel command line in memory: {0}")]
     LoadCmdLine(#[source] linux_loader::loader::Error),
 
+    #[error("Failed to apply landlock config during vm_create: {0}")]
+    ApplyLandlock(#[source] LandlockError),
+
     #[error("Cannot modify the kernel command line: {0}")]
     CmdLineInsertStr(#[source] linux_loader::cmdline::Error),