News for hackers. Stuff that matters.

A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by BoingBoomTschak on Sunday March 23, 2025 @06:58AM (#43452153)
Same question. One thing I really dislike in Bubblewrap is that I must share the whole net user namespace even if all I want to do is use UNIX domain sockets.

Since I only see net options specifying ports, does this handle this use case?

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by coppsilgold on Sunday March 23, 2025 @08:06PM (#43456848)
> if all I want to do is use UNIX domain sockets

I routinely --unshare-net with UDS ro-binds.

You may be using abstract sockets (@/path/uds.sock) and those do require the same netns I think.

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by l0kod on Tuesday March 25, 2025 @01:26PM (#43473727)
Landlock supports scoped abstract UNIX socket: https://docs.kernel.org/userspace-api/landlock.html#ipc-scop...

Landlock doesn't use namespaces, they are orthogonal.

[ Parent | on HN ]