News for hackers. Stuff that matters.

A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by Zoup on Sunday March 23, 2025 @12:47PM (#43454068)
ROX isn't self-contradictory, Allowing read() and execve(), but denying write() and truncate() are totally valid and common in secure execution contexts, although things gets worse with directory traverse.

So yeah, --rox is fine semantically, just ugly. :D

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by zahlman on Sunday March 23, 2025 @09:27PM (#43457194)
I mean that it is not "read-only" if it is also executable.
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by teo_zero on Monday March 24, 2025 @02:11AM (#43458106)
I think the parent poster was not arguing that allowing this combination of accesses is invalid, just that it can't be called read-ONLY if it's not ONLY read.

"Any color the customer wants, as long as it's black"

[ Parent | on HN ]