vmm: vm_config: allow opening /dev/sev after landlock

On KVM, an SEV-SNP guest opens /dev/sev at VM creation and passes
its fd as kvm_sev_cmd.sev_fd. KVM uses it to issue the SNP_LAUNCH_*
commands. The open happens after the landlock ruleset is applied,
so grant rw access to /dev/sev when the sev_snp platform feature
is enabled.

Assisted-by: Claude:Opus-4.8
Signed-off-by: Ruben Hakobyan <hruben@meta.com>

vmm/src/vm_config.rs

@@ -1242,6 +1242,11 @@ impl VmConfig {
             payload.apply_landlock(&mut landlock)?;
         }
 
+        #[cfg(feature = "sev_snp")]
+        if self.platform.as_ref().is_some_and(|p| p.sev_snp) {
+            landlock.add_rule_with_access(Path::new("/dev/sev"), "rw")?;
+        }
+
         if let Some(tpm_config) = &self.tpm {
             tpm_config.apply_landlock(&mut landlock)?;
         }