Landlock LSM: Sandboxing without Root - Practice and Examples
Landlock LSM: Sandboxing in the kernel without root We blindly trust software. An update, a seemingly harmless .deb file, or a quickly downloaded Python script from the customer's server - often the whole chaos runs with full user rights. In the Linux environment, there have long been AppArmor or SELinux to bring some order to this. However, both require administrator rights and a lot...
The Linux kernel's Landlock LSM (Landlock Linux Security Module) allows processes to restrict their own file access rights without requiring administrative privileges. This Mandatory Access Control (MAC) feature, introduced in Linux kernel version 5.13, enables developers to sandbox their applications and limit the damage that can be caused by a potential exploit.
Landlock works by allowing a process to define its own rules for accessing files, effectively creating a sandbox that prevents the process from accessing unauthorized files or directories. The feature can be used through tools like the `landlock` command-line tool or by integrating it directly into applications using system calls like `landlock_add_restriction`.
Written by urgent.news from Dev.to's report — not a translation of it. Machine-written — may contain errors; check the original before relying on it.
