add disable-sandbox option

src/cli/args.rs

@@ -49,6 +49,10 @@ pub struct CliArgs {
     #[arg(short = 'c', long, global = true)]
     pub threads: Option<usize>,
 
+    /// Disable the sandbox feature
+    #[arg(long, global = true)]
+    pub no_sandbox: bool,
+
     // Ouch and claps subcommands
     #[command(subcommand)]
     pub cmd: Subcommand,

src/commands/decompress.rs

@@ -328,9 +328,11 @@ fn execute_decompression(
     //if !input_is_stdin && options.remove {
         //permit write access to input_file_path
     //} else {
-        landlock::init_sandbox(&[output_dir]);
     //}
     
+    //landlock::init_sandbox(&[output_dir]);
+    
+
     if is_smart_unpack {
         return smart_unpack(unpack_fn, output_dir, output_file_path, question_policy);
     }

src/commands/list.rs

@@ -23,13 +23,14 @@ pub fn list_archive_contents(
     list_options: ListOptions,
     question_policy: QuestionPolicy,
     password: Option<&[u8]>,
+    disable_sandbox: bool,
 ) -> crate::Result<()> {
 
     //rar uses a temporary file which needs to be defined early to be permitted in landlock
     let mut temp_file = tempfile::NamedTempFile::new()?;
 
     // Initialize landlock sandbox with write access restricted to /tmp/<tmp_file> as required by some formats
-    landlock::init_sandbox(&[temp_file.path()]);
+    landlock::init_sandbox(&[temp_file.path()], disable_sandbox);
 
     let reader = fs::File::open(archive_path)?;
 

src/commands/mod.rs

@@ -257,7 +257,9 @@ pub fn run(
                     args.password
                         .as_deref()
                         .map(|str| <[u8] as ByteSlice>::from_os_str(str).expect("convert password to bytes failed")),
+                    args.no_sandbox,
                 )?;
+
             }
 
             Ok(())

src/utils/landlock.rs

@@ -77,10 +77,15 @@ fn restrict_paths(hierarchies: &[&str]) -> Result<RestrictionStatus, MyRestrictE
 
 /// Restricts the process to only access the given hierarchies using Landlock, if supported.
 /// Accepts multiple allowed directories as &[&Path].
-pub fn init_sandbox(allowed_dirs: &[&Path]) {
+pub fn init_sandbox(allowed_dirs: &[&Path], disable_sandbox: bool) {
     // if std::env::var("CI").is_ok() {
     //    return;
     // }
+    if disable_sandbox {
+        println!("Sandbox feature disabled via --no-sandbox flag.");
+        // warn!("Security Process isolation disabled");
+        return;
+    }
 
     if is_landlock_supported() {
         let paths: Vec<&str> = allowed_dirs