News for hackers. Stuff that matters.

A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by throwfaraway398 on Saturday March 22, 2025 @04:17PM (#43448309)
I saw there's an option to match on a cgroup among nft meta expressions (but I've never tried it). It could be enough if you just want to add per-process firewall rules, but not configure an additional namespace with it's associated interfaces, routing/nating.
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by kanbankaren on Saturday March 22, 2025 @05:54PM (#43448947)
Yes. You could match packets based on username or even SELinux labels.

You could also set a special mark on a packet for each container and then filter based on that. The Internet is surprsingly very thin on nft resources. I spent a few weeks learning how to write them. Definitely, not for the average consumer.

[ Parent | on HN ]