4 ms·
So it works also by using some cli utility to run my software for example?
by kosolam 11mo ago
So it works also by using some cli utility to run my software for example?
- razighter777 11mo agoYup. There are tools that use landlock to accomplish just that. https://github.com/Zouuup/landrun https://github.com/Zouuup/landrun All you gotta do is apply a policy and do a fork() exec(). There is also support in firejail.
- seethishat 11mo agoFirejail requires SUID, LandLock does not. Also, it's very easy to write your own LandLock policy in the programming language of your choice and wrap whatever program you like rather than downloading stuff from Github. Here's another example in Go: package main import ( "fmt" "github.com/landlock-lsm/go-landlock/landlock" "log" "os" "os/exec" ) func main() { // Define the LandLock policy err := landlock.V1.RestrictPaths(...) // Execute FireFox cmd := exec.Command("/usr/bin/firefox") }
- butvacuum 11mo agoIsn't this example just "downloading stuff from GitHub,"(the external Go dependency) but with extra steps? (Having to write and compile a golang app)
- pdimitar 11mo agoSo you're basically writing a program launcher? In this case this program is what you'd want to have a desktop shortcut to and not to Firefox itself, is that it?
- codethief 11mo agoYeah, see e.g. sydbox: https://gitlab.exherbo.org/sydbox/sydbox https://gitlab.exherbo.org/sydbox/sydbox