News for hackers. Stuff that matters.

A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by o11c on Sunday March 23, 2025 @03:47PM (#43455358)
NO_NEW_PRIVS is quite irritating in a lot of contexts, since it breaks distant dependencies. For example, you can't run `ping`, so good luck debugging your networking!
[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by ignoramous on Monday March 24, 2025 @04:04AM (#43458519)
> For example, you can't run `ping`, so good luck debugging your networking!

Sending ICMP Echo in userspace (over UDP) is a thing on Linux. From experience, for public Internet, where possible, it is always better to rely on TLS connects (then TCP or UDP, and then ICMP) to ascertain connectivity (lest some middleware meddle with IP or Transport replies).

[ Parent | on HN ]