Add --keep-fd to pass chosen inherited descriptors into the sandbox

src/config.rs

@@ -1,5 +1,6 @@
 use std::collections::{HashMap, HashSet};
 use std::ffi::OsString;
+use std::os::fd::RawFd;
 use std::path::{Path, PathBuf};
 
 use serde::Deserialize;
@@ -93,6 +94,7 @@ pub fn build(args: Args, file_config: Option<FileConfig>) -> Result<SandboxConfi
             &profile.options.bwrap_args,
             &globals.bwrap_args,
         ))?,
+        keep_fds: merge_vecs(args.keep_fd, &profile.options.keep_fd, &globals.keep_fd),
         command,
         command_args,
         persistent_tmp_key,
@@ -526,6 +528,8 @@ pub struct Options {
     pub unsetenv: Vec<String>,
     #[serde(default)]
     pub bwrap_args: Vec<String>,
+    #[serde(default)]
+    pub keep_fd: Vec<RawFd>,
 }
 
 impl Options {
@@ -551,6 +555,7 @@ impl Options {
             env: append(self.env, extra.env),
             unsetenv: append(self.unsetenv, extra.unsetenv),
             bwrap_args: append(self.bwrap_args, extra.bwrap_args),
+            keep_fd: append(self.keep_fd, extra.keep_fd),
         }
     }