News for hackers. Stuff that matters.

A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by codedokode on Saturday March 22, 2025 @03:03PM (#43447820)
Bubblewrap is very limited, for example it doesn't allow to grant access to /proc/self/exe without giving access to whole /proc subsystem. So I had to write an emulation of /proc in Python and mount it with FUSE to work around this. I wonder if this issue is fixed in landlock, firejail and others.

Also bubblewrap cannot ask for a decision in runtime: you must set up the rules beforehand.

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by mid-kid on Sunday March 23, 2025 @11:19AM (#43453504)
Emulating /proc isn't super interesting when you can simply enter a new process namespace.
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by codedokode on Sunday March 23, 2025 @09:20PM (#43457170)
This doesn't allow hiding things like /proc/cpuinfo or /proc/cmdline or /proc/modules etc.
[ Parent | on HN ]