Landlock-ing Linux

https://blog.prizrak.me/post/landlock/

Landlock: What Is It?

Landlock is a Linux API that lets applications explicitly declare which resources they are allowed to access. Its philosophy is similar to OpenBSD’s unveil() and (less so) pledge(): programs can make a contract with the kernel stating, “I only need these files or resources — deny me everything else if I’m compromised.”

It provides a simple, developer-friendly way to add defense-in-depth to applications. Compared to traditional Linux security mechanisms, Landlock is vastly easier to understand and integrate.

This post is meant to be an accessible introduction, and hopefully persuade you to give Landlock a try.

49 points · 7 comments · view on lemmy.world

7 Comments

JakenVeina@midwest.social · 17 pts · 266d (1 reply)

So, it's a way for applications to make themselves more hardened against exploitation? Was really confused on first reading the title, but that makes some sense. Applications declare what permissions they need, up-front, so any exploits during normal operation can only operate under that umbrella. Unless the startup processes of the application itself are exploited.

somerandomperson@lemmy.dbzer0.com · 6 pts · 266d

Flatpaks also do that. Kinda.

boredsquirrel@slrpnk.net · 12 pts · 266d (2 replies)

https://codeberg.org/crabjail

Here is a sandboxing tool using that feature

The_Decryptor@aussie.zone · 3 pts · 266d (1 reply)

Landrun as well, takes the restrictions on the command line. Can look messy, but does make it entirely standalone, so you can e.g. drop it into a service file as the readme shows easily enough.

boredsquirrel@slrpnk.net · 2 pts · 264d

Thanks, I have to try that!

I am missing something to isolate my Browser(s) without using Flatpak (as that breaks everything)

sga@piefed.social · 5 pts · 266d

[ removed ]

rycee@lemmy.world · 3 pts · 266d

I didn't know about this API and it seems really cool. Will definitely try it out.

fruitycoder@sh.itjust.works · 1 pts · 265d

Neat. Tbh the app you are securing being the one in charge makes this limited and not a replacement of SELINUX or containers, but it does add some neat features like dynamic controls based on runtime configs that have bit my butt before. So say you set a port or working dir during startup, now it can set landlock to that and the actual process running it will be limited. Very cool still.