News for hackers. Stuff that matters.

A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Saturday March 22, 2025 @08:13PM (#43449774)
in this case doesn't have access to "a" wherever it is...

$ landrun --ro /usr cat /usr/bin/ls | wc -l

400

executing ls (as in actual binary execution) will require --exec

$ landrun --ro /usr ls /usr/bin/

ls: cannot open directory '/usr/bin/': Permission denied

$ landrun --ro /usr --exec ls /usr/bin/

list of billions of files

note that I don't really love the --exec thingy, if it's not "on" by default it's just for sake of being explicit.

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by ranger_danger on Saturday March 22, 2025 @09:08PM (#43450127)
--ro /usr does not apply to /usr/bin. change it to --ro /usr/bin and then cat will refuse to run.
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Saturday March 22, 2025 @10:00PM (#43450354)
it's recursive by default
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by ranger_danger on Saturday March 22, 2025 @10:11PM (#43450405)
well it's not working. please try it
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Sunday March 23, 2025 @09:53AM (#43452939)
give it a try with v0.10: landrun --rox /usr/ --ro /usr/lib ls /usr/bin/
[ Parent | on HN ]