11 ms·

Linux Landlock is a kernel-native security module that lets unprivileged processes sandbox themselves - but nobody uses it because the API is ... hard! I built

by Zoup 2y ago

Linux Landlock is a kernel-native security module that lets unprivileged processes sandbox themselves - but nobody uses it because the API is ... hard! I built `landrun`, a small CLI tool in Go, to make it practical to sandbox any command with fine-grained filesystem and network access controls. No root. No containers. No SELinux/AppArmor configs. It's lightweight, auditable, and wraps Landlock v5 features (file access + TCP restrictions). Demo + usage examples in the README. Would love feedback from the HN crowd!

Filligree 2y ago
I’ll try it, but just off the bat, how does this compare to bubblewrap?
- camkego 2y ago
  I also would like to understand the differences relative to bubblewrap
- bitbang 2y ago
  If I understand it correctly, landlock is an API used by an app to sandbox itself. The app itself controls the sandboxing. Bubble wrap is user space tooling external to the app, so the app had no direct awareness or control of its sandboxing. The scenarios each is intended for are orthogonal to one another.
  - amarshall 2y ago
    Landlock can be used to sandbox a launched sub process, as it is here, just as the Kernel APIs used by Bubblewrap could (and sometimes are!) used by programs to sandbox themselves.
  - 1oooqooq 2y ago
    not exactly correct. bubblewrap, firejail, and i not sure, but maybe even apparmour, all remove capabilities and create+join restricted fs/net namespaces, and then fork the actual thing you want to execute. so it's exactly the same concept, but those use the cap and cgroups.
- codedokode 2y ago
  Bubblewrap is very limited, for example it doesn't allow to grant access to /proc/self/exe without giving access to whole /proc subsystem. So I had to write an emulation of /proc in Python and mount it with FUSE to work around this. I wonder if this issue is fixed in landlock, firejail and others. Also bubblewrap cannot ask for a decision in runtime: you must set up the rules beforehand.
  - mid-kid 2y ago
    Emulating /proc isn't super interesting when you can simply enter a new process namespace.
    - codedokode 2y ago
      This doesn't allow hiding things like /proc/cpuinfo or /proc/cmdline or /proc/modules etc.
- BoingBoomTschak 2y ago
  Same question. One thing I really dislike in Bubblewrap is that I must share the whole net user namespace even if all I want to do is use UNIX domain sockets. Since I only see net options specifying ports, does this handle this use case?
  - coppsilgold 2y ago
    > if all I want to do is use UNIX domain sockets I routinely --unshare-net with UDS ro-binds. You may be using abstract sockets (@/path/uds.sock) and those do require the same netns I think.
    - l0kod 2y ago
      Landlock supports scoped abstract UNIX socket: https://docs.kernel.org/userspace-api/landlock.html#ipc-scoping https://docs.kernel.org/userspace-api/landlock.html#ipc-scop... Landlock doesn't use namespaces, they are orthogonal.
deleted 2y ago
[deleted]
bastiao 2y ago
This seems pretty nice, as it using directly landlock API from the Linux Kernel (like pledge from OpenBSD). One feature I would like to have is like yaml description for some set of configuration rather that use all this arguments. So we could have preconfigured commands and just execute them. But I think it is just a matter of taste. I will try the tool. Thanks for it.
- yjftsjthsd-h 2y ago
  That could be a separate wrapper, like bubblejail is for bubblewrap. Landjail?
- mdaniel 2y ago
  If you want a file format, I'd lobby for one of the existing ones rather than some random yaml one - sandbox-exec's scheme one https://github.com/BrianSwift/macOSSandboxBuild/blob/main/confined.sb https://github.com/BrianSwift/macOSSandboxBuild/blob/main/co... - AppArmor https://wiki.apparmor.net/ https://wiki.apparmor.net/ (although I'm cognizant that tries to address way more than just filesystem access) - Java's permission one https://docs.oracle.com/javase/8/docs/technotes/guides/security/PolicyFiles.html https://docs.oracle.com/javase/8/docs/technotes/guides/secur... Likely tens more
  - bastiao 2y ago
    I agree that re-use file format could a good option. BTW the used landlock go library has sort of example https://github.com/landlock-lsm/go-landlock/blob/main/examples/go-landlock-configurable/cfg.json https://github.com/landlock-lsm/go-landlock/blob/main/exampl...
- Foxboron 2y ago
  Still early but Mickaël Salaün, the author of landlock, is working on this. https://github.com/landlock-lsm/landlockconfig https://github.com/landlock-lsm/landlockconfig I'm going to write up some Go bindings for this when it becomes relevant.
  - 2y ago
linsomniac 2y ago
I didn't have much luck with one of the readme examples: # rm -f /tmp/foo; ./landrun-linux-amd64 --log-level debug --ro /usr/bin --ro /lib --ro /lib64 --rw /tmp touch /tmp/foo [landrun] 2025/03/22 10:28:02 Sandbox config: {ReadOnlyPaths:[/usr/bin /lib /lib64] ReadWritePaths:[/tmp] AllowExec:false BindTCPPorts:[] ConnectTCPPorts:[] BestEffort:true} [landrun:debug] 2025/03/22 10:28:02 Adding read-only path: /usr/bin [landrun:debug] 2025/03/22 10:28:02 Adding read-only path: /lib [landrun:debug] 2025/03/22 10:28:02 Adding read-only path: /lib64 [landrun:debug] 2025/03/22 10:28:02 Adding read-write path: /tmp [landrun:debug] 2025/03/22 10:28:02 Applying Landlock restrictions [landrun] 2025/03/22 10:28:02 Landlock restrictions applied successfully [landrun] 2025/03/22 10:28:02 Executing: [touch /tmp/foo] touch: cannot touch '/tmp/foo': Permission denied Looks very interesting. I'm achieving something somewhat similar by running soeme processes under docker and mounting volumes ro, but could definitely see a usecase for adding landlock to more server processes.
- ranger_danger 2y ago
  This is the minimum options I needed to get it to work: landrun --log-level debug --exec --ro /usr/bin --ro /usr/lib --rw /tmp touch /tmp/foo Personally I don't like that --exec would allow binaries in /tmp to be executed as well...
  - nine_k 2y ago
    As a workaround you could create a tmpfs device like /tmp_noexec with noexec flag, and mount it instead of the normal /tmp. But landrun does not (yet?) allow changing the name in directory options :( For added security, I'd create an ephemeral tmpfs disk for each landlocked invocation: obviously the program we're running has no business seeing what other processes may have put to /tmp.
    - ranger_danger 2y ago
      > I'd create an ephemeral tmpfs disk for each landlocked invocation And now you've just invented firejail.
rainworld 2y ago
// If we have no rules, just return if len(rules) == 0 { log.Info("No sandbox rules to apply") return nil } Really cool and well-written project, but I disagree with this choice: No rules should mean no rules (everything denied). I would have suggested support for more fine-grained file/directory permissions—good to see that’s already planned.
- Zoup 2y ago
  Yeah I agree with that, just release a new version that does that.
  - rainworld 2y ago
    Does Linux 6.8 in fact ship ABI v5? At least it’s not guaranteed (Ubuntu 24.04, 6.8.0-55-generic). This post suggests 6.10: https://lore.kernel.org/landlock/20240716.yui4Iezai8ae@digikod.net/ https://lore.kernel.org/landlock/20240716.yui4Iezai8ae@digik...
    - Zoup 2y ago
      good catch, fixed.
__turbobrew__ 2y ago
> but nobody uses it because the API is ... hard! OpenBSD really got it right with pledge and unveil.
- gnoack 2y ago
  OpenBSD did get it right, but they also have a more relaxed scheme for backwards compatibility across releases. Linux's strict ABI compatibility guarantees complicate matters slightly, but with the right supporting library it becomes tolerable. See the example at the top of the Readme at https://github.com/landlock-lsm/go-landlock https://github.com/landlock-lsm/go-landlock (Full disclosure, I am the author of that library) FWIW, I do hope that we can motivate people to use Landlock in the same way as people use pledge on OpenBSD, as a lightweight self-sandboxing mechanism that requires fewer architectural changes to your program and results in more constrained sandboxes than Linux namespaces and other mechanisms do.
  - __turbobrew__ 2y ago
    As far as I know the ABI for pledge and unveil really haven’t changed since release? What is stopping linux from creating NEW security primitives which are easy to use? We have wireguard in the linux kernel as a recent addition. Wireguard shows that new simple primitives can be added to the kernel, it requires someone with “good taste” to do the implementation without sacrificing usability.
    - l0kod 2y ago
      BSD systems ship a kernel and user space, which simplifies a lot of things. Linux is more flexible but it comes at a cost. Adding new security features can also be challenging for other reasons. Anyway, Landlock is one of these new security primitives, and it is gaining new features over time. The Landlock interface must not change the underlying semantic of what is allowed or denied, otherwise it could break apps build for an older or a newer kernel. However, these apps should still use all the available security features. This is challenging. Landlock provides a way to define fine-grained security policies. I would not say the kernel interface is complex (rather flexible), but what really matter are the user space library interfaces and how they can safely abstract complexity.
BlimpSpike 2y ago
Similarly to the bubblewrap comment, I'd also like to know how it compares to nsjail. I think nsjail uses mount namespaces (CLONE_NEWNS) instead of landlock for filesystem sandboxing, but what would the practical differences be?
trikko 2y ago
Are (abstract) unix sockets supported? I'm trying to run a self-contained webserver executable without any external dependency. It starts but daemon <-> workers communication doesn't seem working (it is done via unix socket) It works fine with bubblewrap or inside a scratch docker container.
- deleted 2y ago
  [deleted]
- dsp_person 2y ago
  aren't abstract sockets un-jailable unless using network namespaces? or in the other direction, to truly prevent e.g. xorg socket from being accessed by a bubblejailed application, it should exclude --share-net, regardless if you bind the actual path to the socket (since abstract permeates beyond that)
  - trikko 2y ago
    Well, so should it work? You're telling me there's another reason, then... Can't guess which one. Hmmm...
    - Zoup 2y ago
      they can be jailed by landlock, we don't have support in go-landlock tho afaik, @Gnoack
      - gnoack 2y ago
        It's tracked in https://github.com/landlock-lsm/go-landlock/issues/35 https://github.com/landlock-lsm/go-landlock/issues/35 - signals and abstract Unix sockets do unfortunately not interact well with the inherently multithreaded Go runtime. We are working on a fix in https://github.com/landlock-lsm/go-landlock/issues/36 https://github.com/landlock-lsm/go-landlock/issues/36 but this needs to be on the kernel side and this is delaying this feature in Go, unfortunately. It is usable from (single threaded) C programs though.
Zoup 2y ago
V0.1.3 is out now!
JohnTheSealion 2y ago
How does Landrun compare to Firejail?
rmccue 2y ago
I’d recommend adding your first (and maybe second) paragraphs directly to your readme - this is a much clearer description if you don’t know what landlock is already!
- cryptonector 2y ago
  I agree. The first section of the README leaves the impression that Landrun comes with a kernel module -- that would be a red flag for me. The fact that it uses an existing kernel module that is in the mainline is going to be critical to anyone using Landrun.
MaxMatti 2y ago
There's conflicting information in the readme about whether --best-effort is enabled or disabled by default.

by Zoup 2y ago

Filligree 2y ago

I’ll try it, but just off the bat, how does this compare to bubblewrap?

camkego 2y ago
I also would like to understand the differences relative to bubblewrap
bitbang 2y ago
If I understand it correctly, landlock is an API used by an app to sandbox itself. The app itself controls the sandboxing. Bubble wrap is user space tooling external to the app, so the app had no direct awareness or control of its sandboxing. The scenarios each is intended for are orthogonal to one another.
- amarshall 2y ago
  Landlock can be used to sandbox a launched sub process, as it is here, just as the Kernel APIs used by Bubblewrap could (and sometimes are!) used by programs to sandbox themselves.
- 1oooqooq 2y ago
  not exactly correct. bubblewrap, firejail, and i not sure, but maybe even apparmour, all remove capabilities and create+join restricted fs/net namespaces, and then fork the actual thing you want to execute. so it's exactly the same concept, but those use the cap and cgroups.
codedokode 2y ago
Bubblewrap is very limited, for example it doesn't allow to grant access to /proc/self/exe without giving access to whole /proc subsystem. So I had to write an emulation of /proc in Python and mount it with FUSE to work around this. I wonder if this issue is fixed in landlock, firejail and others. Also bubblewrap cannot ask for a decision in runtime: you must set up the rules beforehand.
- mid-kid 2y ago
  Emulating /proc isn't super interesting when you can simply enter a new process namespace.
  - codedokode 2y ago
    This doesn't allow hiding things like /proc/cpuinfo or /proc/cmdline or /proc/modules etc.
BoingBoomTschak 2y ago
Same question. One thing I really dislike in Bubblewrap is that I must share the whole net user namespace even if all I want to do is use UNIX domain sockets. Since I only see net options specifying ports, does this handle this use case?
- coppsilgold 2y ago
  > if all I want to do is use UNIX domain sockets I routinely --unshare-net with UDS ro-binds. You may be using abstract sockets (@/path/uds.sock) and those do require the same netns I think.
  - l0kod 2y ago
    Landlock supports scoped abstract UNIX socket: https://docs.kernel.org/userspace-api/landlock.html#ipc-scoping https://docs.kernel.org/userspace-api/landlock.html#ipc-scop... Landlock doesn't use namespaces, they are orthogonal.

deleted 2y ago

[deleted]

bastiao 2y ago

This seems pretty nice, as it using directly landlock API from the Linux Kernel (like pledge from OpenBSD). One feature I would like to have is like yaml description for some set of configuration rather that use all this arguments. So we could have preconfigured commands and just execute them. But I think it is just a matter of taste. I will try the tool. Thanks for it.

yjftsjthsd-h 2y ago
That could be a separate wrapper, like bubblejail is for bubblewrap. Landjail?
mdaniel 2y ago
If you want a file format, I'd lobby for one of the existing ones rather than some random yaml one - sandbox-exec's scheme one https://github.com/BrianSwift/macOSSandboxBuild/blob/main/confined.sb https://github.com/BrianSwift/macOSSandboxBuild/blob/main/co... - AppArmor https://wiki.apparmor.net/ https://wiki.apparmor.net/ (although I'm cognizant that tries to address way more than just filesystem access) - Java's permission one https://docs.oracle.com/javase/8/docs/technotes/guides/security/PolicyFiles.html https://docs.oracle.com/javase/8/docs/technotes/guides/secur... Likely tens more
- bastiao 2y ago
  I agree that re-use file format could a good option. BTW the used landlock go library has sort of example https://github.com/landlock-lsm/go-landlock/blob/main/examples/go-landlock-configurable/cfg.json https://github.com/landlock-lsm/go-landlock/blob/main/exampl...
Foxboron 2y ago
Still early but Mickaël Salaün, the author of landlock, is working on this. https://github.com/landlock-lsm/landlockconfig https://github.com/landlock-lsm/landlockconfig I'm going to write up some Go bindings for this when it becomes relevant.
- 2y ago

linsomniac 2y ago

I didn't have much luck with one of the readme examples: # rm -f /tmp/foo; ./landrun-linux-amd64 --log-level debug --ro /usr/bin --ro /lib --ro /lib64 --rw /tmp touch /tmp/foo [landrun] 2025/03/22 10:28:02 Sandbox config: {ReadOnlyPaths:[/usr/bin /lib /lib64] ReadWritePaths:[/tmp] AllowExec:false BindTCPPorts:[] ConnectTCPPorts:[] BestEffort:true} [landrun:debug] 2025/03/22 10:28:02 Adding read-only path: /usr/bin [landrun:debug] 2025/03/22 10:28:02 Adding read-only path: /lib [landrun:debug] 2025/03/22 10:28:02 Adding read-only path: /lib64 [landrun:debug] 2025/03/22 10:28:02 Adding read-write path: /tmp [landrun:debug] 2025/03/22 10:28:02 Applying Landlock restrictions [landrun] 2025/03/22 10:28:02 Landlock restrictions applied successfully [landrun] 2025/03/22 10:28:02 Executing: [touch /tmp/foo] touch: cannot touch '/tmp/foo': Permission denied Looks very interesting. I'm achieving something somewhat similar by running soeme processes under docker and mounting volumes ro, but could definitely see a usecase for adding landlock to more server processes.

ranger_danger 2y ago
This is the minimum options I needed to get it to work: landrun --log-level debug --exec --ro /usr/bin --ro /usr/lib --rw /tmp touch /tmp/foo Personally I don't like that --exec would allow binaries in /tmp to be executed as well...
- nine_k 2y ago
  As a workaround you could create a tmpfs device like /tmp_noexec with noexec flag, and mount it instead of the normal /tmp. But landrun does not (yet?) allow changing the name in directory options :( For added security, I'd create an ephemeral tmpfs disk for each landlocked invocation: obviously the program we're running has no business seeing what other processes may have put to /tmp.
  - ranger_danger 2y ago
    > I'd create an ephemeral tmpfs disk for each landlocked invocation And now you've just invented firejail.

rainworld 2y ago

// If we have no rules, just return if len(rules) == 0 { log.Info("No sandbox rules to apply") return nil } Really cool and well-written project, but I disagree with this choice: No rules should mean no rules (everything denied). I would have suggested support for more fine-grained file/directory permissions—good to see that’s already planned.

Zoup 2y ago
Yeah I agree with that, just release a new version that does that.
- rainworld 2y ago
  Does Linux 6.8 in fact ship ABI v5? At least it’s not guaranteed (Ubuntu 24.04, 6.8.0-55-generic). This post suggests 6.10: https://lore.kernel.org/landlock/20240716.yui4Iezai8ae@digikod.net/ https://lore.kernel.org/landlock/20240716.yui4Iezai8ae@digik...
  - Zoup 2y ago
    good catch, fixed.

__turbobrew__ 2y ago

> but nobody uses it because the API is ... hard! OpenBSD really got it right with pledge and unveil.

gnoack 2y ago
OpenBSD did get it right, but they also have a more relaxed scheme for backwards compatibility across releases. Linux's strict ABI compatibility guarantees complicate matters slightly, but with the right supporting library it becomes tolerable. See the example at the top of the Readme at https://github.com/landlock-lsm/go-landlock https://github.com/landlock-lsm/go-landlock (Full disclosure, I am the author of that library) FWIW, I do hope that we can motivate people to use Landlock in the same way as people use pledge on OpenBSD, as a lightweight self-sandboxing mechanism that requires fewer architectural changes to your program and results in more constrained sandboxes than Linux namespaces and other mechanisms do.
- __turbobrew__ 2y ago
  As far as I know the ABI for pledge and unveil really haven’t changed since release? What is stopping linux from creating NEW security primitives which are easy to use? We have wireguard in the linux kernel as a recent addition. Wireguard shows that new simple primitives can be added to the kernel, it requires someone with “good taste” to do the implementation without sacrificing usability.
  - l0kod 2y ago
    BSD systems ship a kernel and user space, which simplifies a lot of things. Linux is more flexible but it comes at a cost. Adding new security features can also be challenging for other reasons. Anyway, Landlock is one of these new security primitives, and it is gaining new features over time. The Landlock interface must not change the underlying semantic of what is allowed or denied, otherwise it could break apps build for an older or a newer kernel. However, these apps should still use all the available security features. This is challenging. Landlock provides a way to define fine-grained security policies. I would not say the kernel interface is complex (rather flexible), but what really matter are the user space library interfaces and how they can safely abstract complexity.

BlimpSpike 2y ago

Similarly to the bubblewrap comment, I'd also like to know how it compares to nsjail. I think nsjail uses mount namespaces (CLONE_NEWNS) instead of landlock for filesystem sandboxing, but what would the practical differences be?

trikko 2y ago

Are (abstract) unix sockets supported? I'm trying to run a self-contained webserver executable without any external dependency. It starts but daemon <-> workers communication doesn't seem working (it is done via unix socket) It works fine with bubblewrap or inside a scratch docker container.

deleted 2y ago
[deleted]
dsp_person 2y ago
aren't abstract sockets un-jailable unless using network namespaces? or in the other direction, to truly prevent e.g. xorg socket from being accessed by a bubblejailed application, it should exclude --share-net, regardless if you bind the actual path to the socket (since abstract permeates beyond that)
- trikko 2y ago
  Well, so should it work? You're telling me there's another reason, then... Can't guess which one. Hmmm...
  - Zoup 2y ago
    they can be jailed by landlock, we don't have support in go-landlock tho afaik, @Gnoack
    - gnoack 2y ago
      It's tracked in https://github.com/landlock-lsm/go-landlock/issues/35 https://github.com/landlock-lsm/go-landlock/issues/35 - signals and abstract Unix sockets do unfortunately not interact well with the inherently multithreaded Go runtime. We are working on a fix in https://github.com/landlock-lsm/go-landlock/issues/36 https://github.com/landlock-lsm/go-landlock/issues/36 but this needs to be on the kernel side and this is delaying this feature in Go, unfortunately. It is usable from (single threaded) C programs though.

Zoup 2y ago

V0.1.3 is out now!

JohnTheSealion 2y ago

How does Landrun compare to Firejail?

rmccue 2y ago

I’d recommend adding your first (and maybe second) paragraphs directly to your readme - this is a much clearer description if you don’t know what landlock is already!

cryptonector 2y ago
I agree. The first section of the README leaves the impression that Landrun comes with a kernel module -- that would be a red flag for me. The fact that it uses an existing kernel module that is in the mainline is going to be critical to anyone using Landrun.

MaxMatti 2y ago

There's conflicting information in the readme about whether --best-effort is enabled or disabled by default.