{
  "id": 6825237,
  "title": "Landlock LSM: Sandboxing without Root - Practice and Examples",
  "url": "https://urgent.news/2026/09/12/landlock-lsm-sandboxen-ohne-root-praxis-und-beispiele",
  "topic": "tech",
  "section": "Tech",
  "published": "2026-09-12T00:00:24.000Z",
  "source": {
    "name": "Dev.to",
    "slug": "dev-to",
    "url": "https://dev.to/uhltak/landlock-lsm-sandboxen-ohne-root-praxis-und-beispiele-2gha"
  },
  "original_language": "de",
  "account": "The Linux kernel's Landlock LSM (Landlock Linux Security Module) allows processes to restrict their own file access rights without requiring administrative privileges. This Mandatory Access Control (MAC) feature, introduced in Linux kernel version 5.13, enables developers to sandbox their applications and limit the damage that can be caused by a potential exploit. Landlock works by allowing a process to define its own rules for accessing files, effectively creating a sandbox that prevents the process from accessing unauthorized files or directories. The feature can be used through tools like the `landlock` command-line tool or by integrating it directly into applications using system calls like `landlock_add_restriction`.",
  "summary": "Landlock LSM is a new Mandatory Access Control (MAC) in the Linux kernel, version 5.13 and above, allowing processes to restrict their own file access permissions without requiring root privileges. This innovative approach offers a more secure alternative to traditional Linux Security Modules like AppArmor and SELinux, which require administrative rights and extensive configuration. By enabling Landlock, users can sandbox their applications and limit their access to specific files and directories, reducing the attack surface and improving overall system security.",
  "key_points": [],
  "editors_take": null,
  "illustration": null,
  "coverage": {
    "outlets": 1,
    "also_reported_by": []
  },
  "ai_generated": true,
  "disclaimer": "Summaries, key points and the editor’s take are written by software from other outlets’ reporting and may contain errors — always check the linked original."
}