refactor(linux): extract landlock restrict_self into a standalone function

Move the closure that calls `restrict_self` into a named function to improve readability and reduce nesting inside the `pre_exec` call.

Auto-committed-on: dragonfly
Co-authored-by: Medulla <medulla@tinyhumans.ai>

Author: senamakel

crates/tinybox-jail/src/linux.rs

@@ -91,14 +91,7 @@ impl JailBackend for LandlockBackend {
 
             // SAFETY: the child callback only applies this prebuilt ruleset.
             unsafe {
-                cmd.pre_exec(move || {
-                    apply_ruleset(ruleset.take(), |ruleset| {
-                        ruleset
-                            .restrict_self()
-                            .map(|_| ())
-                            .map_err(|_| std::io::Error::from_raw_os_error(5))
-                    })
-                });
+                cmd.pre_exec(move || apply_ruleset(ruleset.take(), restrict_self));
             }
 
             cmd.spawn()
@@ -122,6 +115,14 @@ fn apply_ruleset<T>(
     }
 }
 
+#[cfg(feature = "landlock")]
+fn restrict_self(ruleset: landlock::Ruleset) -> std::io::Result<()> {
+    ruleset
+        .restrict_self()
+        .map(|_| ())
+        .map_err(|_| std::io::Error::from_raw_os_error(5))
+}
+
 #[cfg(test)]
 #[path = "linux_tests.rs"]
 mod tests;