News for hackers. Stuff that matters.

A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Saturday March 22, 2025 @07:20PM (#43449491)
yeah you are missing --exec there, which feels a bit useless that you have to mention it, but I prefer things explicit and use all LSM can provide, I can imagine cases where --exec isn't really required. like `cat`.

either case have a look at latest release, it's a bit cleaner.

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by mikedelfino on Sunday March 23, 2025 @08:52AM (#43452563)
Could you please help me understand why exec is required for this touch example? Is it necessary to actually launch the touch binary? Or touch itself exec()s something else?
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by extraduder_ire on Sunday March 23, 2025 @01:51PM (#43454519)
This might be related to needing execute permissions (filesystem x bit) on the directory to modify files within.
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by mikedelfino on Sunday March 23, 2025 @02:25PM (#43454742)
Got it. I thought it had to do with execve() syscall.
[ Parent | on HN ]