5 ms·
I hope so too :) There are libraries at https://github.com/landlock-lsm https://github.com/landlock-lsm to simplify that, I'm using these productively for a few
by gnoack 5y ago
I hope so too :) There are libraries at https://github.com/landlock-lsm https://github.com/landlock-lsm to simplify that, I'm using these productively for a few months.
(In fact, I'm sending this from a landlocked web browser. :))
This also ties into the discussion thread about firejail being suid-root - Other than namespaces, Landlock is an unprivileged sandboxing mechanism and doesn't need to escalate privileges in order to drop privileges.
- staticassertion 5y agoHonestly, user namespaces might be scarier to me than setuid lol hopefully one day that will change.
- gnoack 5y agoSorry, my English... :) I meant "Unlike namespaces", not "Other than namespaces" -- Landlock does not use namespaces.
- staticassertion 5y agoYeah, I realized after that that was probably the case. I assume it uses unpriv ebpf? A bit less scary lol
- gnoack 5y agoeBPF was the initial proposal, but Landlock didn't go with it in the end. It's just using a set of regular system calls, the logic behind it is just implemented in C in the kernel as a LSM.