5 ms·

I didn't have much luck with one of the readme examples: # rm -f /tmp/foo; ./landrun-linux-amd64 --log-level debug --ro /usr/bin --ro /lib --ro /lib64 --rw

• ranger_danger 2y ago
  This is the minimum options I needed to get it to work: landrun --log-level debug --exec --ro /usr/bin --ro /usr/lib --rw /tmp touch /tmp/foo Personally I don't like that --exec would allow binaries in /tmp to be executed as well...
  • nine_k 2y ago
    As a workaround you could create a tmpfs device like /tmp_noexec with noexec flag, and mount it instead of the normal /tmp. But landrun does not (yet?) allow changing the name in directory options :( For added security, I'd create an ephemeral tmpfs disk for each landlocked invocation: obviously the program we're running has no business seeing what other processes may have put to /tmp.
    • ranger_danger 2y ago
      > I'd create an ephemeral tmpfs disk for each landlocked invocation And now you've just invented firejail.
      • nine_k 2y ago
        UX-wise, yes. Internally firejail and landrun use different isolation APIs.
        • ranger_danger 2y ago
          Firejail supports Landlock though: https://github.com/netblue30/firejail/pull/6078 https://github.com/netblue30/firejail/pull/6078
  • qwertox 2y ago
    But `landrun --ro /usr/bin --ro /lib --ro /lib64 --rw /path/to/dir touch /path/to/dir/newfile` vs `landrun --ro /usr/bin --ro /lib --ro /lib64 --exec /usr/bin/bash` seems to indicate that `--exec` is only required if the command you're executing then uses an `exec`-call internally, which `bash` would need to be able to fork. So `touch` should not need `--exec`, while `bash` should be able to run anything it can read (including that whitelisted `/tmp`).
    • ranger_danger 2y ago
      The former does not work for me, I have to add --exec. I can only assume it's because touch is in /usr/bin and so it needs permission to execute it from there. It seems that using --ro or --rw at all makes --exec also mandatory.
      • Zoup 2y ago
        well yeah you'll need --exec when you want to run binaries (unlike... cat?) I hope landlock adds support to bind --exec to actual directories, that'll be fun!
        • ranger_danger 2y ago
          > you'll need --exec when you want to run binaries well when wouldn't it do that? in what scenario could you even use this tool without needing to execute a binary?
          • Zoup 2y ago
            running cat isn't a --exec for one :)
            • ranger_danger 2y ago
              how so? $ landrun --ro /usr/bin cat a [landrun:error] 2025/03/22 23:50:16 permission denied
• bastiao 2y ago
  Would be possible/make sense to use landlock on OCI/containers land?
  • codethief 2y ago
    Syd[0] uses landlock (among many other mechanisms) to containerize applications and provides an OCI-compatible interface. [0]: https://gitlab.exherbo.org/sydbox/sydbox https://gitlab.exherbo.org/sydbox/sydbox
    • ranger_danger 2y ago
      that looks really cool, but unfortunately without any obvious examples or even a link to documentation, I'm closing the tab and likely forgetting it exists... I would assume many others would feel the same way.
      • bastiao 2y ago
        True! I had the same feeling.
      • codethief 2y ago
        From the README: > Read the fine manuals of syd, libsyd, gosyd, plsyd, pysyd, rbsyd, syd.el and watch the asciicasts Memory Sandboxing, PID Sandboxing, Network Sandboxing, and Sandboxing Emacs with syd. I do agree, though, that the docs could be improved.
      • rcdwealth 2y ago
        [dead]
    • ammmir 2y ago
      thanks for the link, Sydbox seems like a super cool project, but there's something weird about it: too many links in the README. not on GitHub, and the project that's on GitHub with a similar name hasn't had a commit in 16 years, is it by the same person? if they can polish up the public facing side of the project, it would instill more confidence.
• Zoup 2y ago
  yeah you are missing --exec there, which feels a bit useless that you have to mention it, but I prefer things explicit and use all LSM can provide, I can imagine cases where --exec isn't really required. like `cat`. either case have a look at latest release, it's a bit cleaner.
  • mikedelfino 2y ago
    Could you please help me understand why exec is required for this touch example? Is it necessary to actually launch the touch binary? Or touch itself exec()s something else?
    • extraduder_ire 2y ago
      This might be related to needing execute permissions (filesystem x bit) on the directory to modify files within.
      • mikedelfino 2y ago
        Got it. I thought it had to do with execve() syscall.