News for hackers. Stuff that matters.

A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Foxboron on Saturday March 22, 2025 @03:39PM (#43448073)
Still early but Mickaël Salaün, the author of landlock, is working on this.

https://github.com/landlock-lsm/landlockconfig

I'm going to write up some Go bindings for this when it becomes relevant.

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by gnoack on Saturday March 22, 2025 @04:24PM (#43448359)
(Author of go-Landlock here)

Awesome! I'm happy to hear that you and others are interested in the configuration language. We should probably coordinate that on the Landlock mailing list when the time comes, so that we don't duplicate that work. We are open to outside contributions :)

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by ARob109 on Saturday March 22, 2025 @05:01PM (#43448598)
Would be cool to see integration of landlock with configuration file in a way that a service launched by systemd can apply the configuration to the executable.

Akin to systemd SystemCallFilter directive for no-code application of seccomp filters to the sandboxed process https://www.freedesktop.org/software/systemd/man/latest/syst...

[ Parent | on HN ]