6 ms·
Honestly, user namespaces might be scarier to me than setuid lol hopefully one day that will change.
by staticassertion 5y ago
Honestly, user namespaces might be scarier to me than setuid lol hopefully one day that will change.
- gnoack 5y agoSorry, my English... :) I meant "Unlike namespaces", not "Other than namespaces" -- Landlock does not use namespaces.
- staticassertion 5y agoYeah, I realized after that that was probably the case. I assume it uses unpriv ebpf? A bit less scary lol
- gnoack 5y agoeBPF was the initial proposal, but Landlock didn't go with it in the end. It's just using a set of regular system calls, the logic behind it is just implemented in C in the kernel as a LSM.