review: address all 6 Copilot review comments

src/shadow-core/src/hardening.rs

@@ -62,7 +62,7 @@ pub fn sanitized_env() -> Vec<(String, String)> {
 /// Best-effort: silently does nothing on kernels without Landlock support.
 /// `rw_paths` get read+write access, `ro_paths` get read-only access,
 /// `exec_paths` get execute access. Everything else is denied.
-#[cfg(feature = "landlock")]
+#[cfg(all(feature = "landlock", target_os = "linux"))]
 pub fn apply_landlock(
     writable: &[&std::path::Path],
     readable: &[&std::path::Path],
@@ -72,6 +72,9 @@ pub fn apply_landlock(
         ABI, Access, AccessFs, Ruleset, RulesetAttr, RulesetCreatedAttr, path_beneath_rules,
     };
 
+    // V5 is the maximum ABI we request; Ruleset's default CompatLevel
+    // (BestEffort) automatically downgrades to whatever the running
+    // kernel actually supports, so this is safe on older kernels.
     let abi = ABI::V5;
     let all_access = AccessFs::from_all(abi);
     let read_access = AccessFs::from_read(abi);
@@ -85,14 +88,12 @@ pub fn apply_landlock(
         .and_then(|rs| rs.add_rules(path_beneath_rules(exec_paths, exec_access)))
         .and_then(landlock::RulesetCreated::restrict_self);
 
-    // Best-effort: log but don't fail
-    if let Err(e) = result {
-        eprintln!("landlock: {e}");
-    }
+    // Best-effort: silently ignore errors (unsupported kernel, etc.)
+    let _ = result;
 }
 
 /// No-op on non-Linux or when the `landlock` feature is disabled.
-#[cfg(not(feature = "landlock"))]
+#[cfg(not(all(feature = "landlock", target_os = "linux")))]
 pub fn apply_landlock(
     _writable: &[&std::path::Path],
     _readable: &[&std::path::Path],

src/uu/passwd/src/passwd.rs

@@ -117,7 +117,8 @@ impl UError for PasswdError {
 
 /// Restrict filesystem access using landlock (Linux 5.13+).
 ///
-/// Best-effort Landlock sandboxing for passwd.
+/// Best-effort Landlock sandboxing for passwd. Silently does nothing on
+/// kernels without Landlock support or when the feature is disabled.
 ///
 /// Restricts filesystem access to only what passwd needs:
 /// read+write `/etc/` (passwd/shadow files) and `/dev/` (tty for prompts),

util/generate-completions.sh

@@ -16,13 +16,8 @@ OUTPUT_DIR="${2:-}"
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
 PROJECT_DIR="$(cd "$SCRIPT_DIR/.." && pwd)"
 
-# Build the completions binary
-cargo build --manifest-path "$PROJECT_DIR/Cargo.toml" --features completions --bin shadow-rs-completions
-
-BINARY="$PROJECT_DIR/target/debug/shadow-rs-completions"
-
 if [ -n "$OUTPUT_DIR" ]; then
-    "$BINARY" --all --shell "$SHELL_TYPE" --dir "$OUTPUT_DIR"
+    cargo run --manifest-path "$PROJECT_DIR/Cargo.toml" --features completions --bin shadow-rs-completions -- --all --shell "$SHELL_TYPE" --dir "$OUTPUT_DIR"
 else
-    "$BINARY" --all --shell "$SHELL_TYPE"
+    cargo run --manifest-path "$PROJECT_DIR/Cargo.toml" --features completions --bin shadow-rs-completions -- --all --shell "$SHELL_TYPE"
 fi