Landrun: Sandbox any Linux process using Landlock, no root or containers

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by dsp_person on Sunday March 23, 2025 @03:26AM (#43451392)

aren't abstract sockets un-jailable unless using network namespaces?

or in the other direction, to truly prevent e.g. xorg socket from being accessed by a bubblejailed application, it should exclude --share-net, regardless if you bind the actual path to the socket (since abstract permeates beyond that)

[ Parent | on HN ]

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by trikko on Sunday March 23, 2025 @05:02AM (#43451683)

Well, so should it work?

You're telling me there's another reason, then... Can't guess which one.

Hmmm...

[ Parent | on HN ]

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Sunday March 23, 2025 @12:59PM (#43454141)

they can be jailed by landlock, we don't have support in go-landlock tho afaik, @Gnoack

[ Parent | on HN ]

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by gnoack on Sunday March 23, 2025 @02:28PM (#43454765)

It's tracked in https://github.com/landlock-lsm/go-landlock/issues/35 - signals and abstract Unix sockets do unfortunately not interact well with the inherently multithreaded Go runtime. We are working on a fix in https://github.com/landlock-lsm/go-landlock/issues/36 but this needs to be on the kernel side and this is delaying this feature in Go, unfortunately. It is usable from (single threaded) C programs though.

[ Parent | on HN ]

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Sunday March 23, 2025 @02:41PM (#43454840)

Thanks!

[ Parent | on HN ]