Unblock POSIX message queues in Landlock

[MikeMcQuaid]

• Sandboxed glibc tests open POSIX queues for reading and fail with EACCES when Landlock handles read restrictions.
• Limit the extra right to read-restricted profiles because Landlock rejects rights omitted from the ruleset's handled mask.

See Homebrew/homebrew-core#294936 (comment)

---

• Have you followed our Contributing guidelines?
• Have you checked for other open Pull Requests for the same change?
• Have you explained what your changes do? Performance claims (e.g. "this is faster") must include Hyperfine benchmarks.
• Have you explained why you'd like these changes included, not just what they do?
• For bug fixes, have you given step-by-step brew commands to reproduce the bug?
• Have you written new tests (excluding integration tests)? Here's an example.
• Have you successfully run brew lgtm (style, typechecking and tests) locally?

---

• AI was used to generate or assist with generating this PR.

OpenAI 5.6 sol xhigh with local review and unit testing (not done on a Linux machine).

---

[Copilot]

Pull request overview

This PR adjusts Homebrew’s Linux Landlock sandbox rules to avoid EACCES failures when POSIX message queues are opened for reading under profiles that enable Landlock read restrictions (i.e., when read access is being handled by the ruleset).

Changes:

• Grant ACCESS_FS_READ_FILE on /dev/mqueue only when Landlock is handling read restrictions (@deny_read), preserving expected behaviour for POSIX message queues.
• Update the Landlock sandbox spec to reflect the new access mask used for /dev/mqueue in read-restricted profiles.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
Library/Homebrew/extend/os/linux/sandbox/landlock.rb	Adds conditional read-file permission for /dev/mqueue when @deny_read is enabled so message-queue reads don’t fail under Landlock.
Library/Homebrew/test/sandbox_landlock_spec.rb	Updates the expected /dev/mqueue access mask in the “standard device and POSIX IPC paths” test to match the new permissions.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.