3 ms·
As a workaround you could create a tmpfs device like /tmp_noexec with noexec flag, and mount it instead of the normal /tmp. But landrun does not (yet?) allow ch
by nine_k 2y ago
As a workaround you could create a tmpfs device like /tmp_noexec with noexec flag, and mount it instead of the normal /tmp. But landrun does not (yet?) allow changing the name in directory options :(
For added security, I'd create an ephemeral tmpfs disk for each landlocked invocation: obviously the program we're running has no business seeing what other processes may have put to /tmp.
- ranger_danger 2y ago> I'd create an ephemeral tmpfs disk for each landlocked invocation And now you've just invented firejail.
- nine_k 2y agoUX-wise, yes. Internally firejail and landrun use different isolation APIs.
- ranger_danger 2y agoFirejail supports Landlock though: https://github.com/netblue30/firejail/pull/6078 https://github.com/netblue30/firejail/pull/6078