News for hackers. Stuff that matters.

A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by ranger_danger on Saturday March 22, 2025 @05:27PM (#43448784)
The former does not work for me, I have to add --exec. I can only assume it's because touch is in /usr/bin and so it needs permission to execute it from there.

It seems that using --ro or --rw at all makes --exec also mandatory.

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Saturday March 22, 2025 @07:22PM (#43449503)
well yeah you'll need --exec when you want to run binaries (unlike... cat?) I hope landlock adds support to bind --exec to actual directories, that'll be fun!
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by ranger_danger on Saturday March 22, 2025 @07:35PM (#43449599)
> you'll need --exec when you want to run binaries

well when wouldn't it do that? in what scenario could you even use this tool without needing to execute a binary?

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Saturday March 22, 2025 @07:46PM (#43449646)
running cat isn't a --exec for one :)
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by ranger_danger on Saturday March 22, 2025 @07:50PM (#43449667)
how so?

$ landrun --ro /usr/bin cat a

[landrun:error] 2025/03/22 23:50:16 permission denied

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Saturday March 22, 2025 @08:13PM (#43449774)
in this case doesn't have access to "a" wherever it is...

$ landrun --ro /usr cat /usr/bin/ls | wc -l

400

executing ls (as in actual binary execution) will require --exec

$ landrun --ro /usr ls /usr/bin/

ls: cannot open directory '/usr/bin/': Permission denied

$ landrun --ro /usr --exec ls /usr/bin/

list of billions of files

note that I don't really love the --exec thingy, if it's not "on" by default it's just for sake of being explicit.

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by ranger_danger on Saturday March 22, 2025 @09:08PM (#43450127)
--ro /usr does not apply to /usr/bin. change it to --ro /usr/bin and then cat will refuse to run.
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Saturday March 22, 2025 @10:00PM (#43450354)
it's recursive by default
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by ranger_danger on Saturday March 22, 2025 @10:11PM (#43450405)
well it's not working. please try it
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Sunday March 23, 2025 @09:53AM (#43452939)
give it a try with v0.10: landrun --rox /usr/ --ro /usr/lib ls /usr/bin/
[ Parent | on HN ]