News for hackers. Stuff that matters.

A comment on Landrun: Sandbox any Linux process using Landlock, no root or containers. Parent comment

Re:Landrun: Sandbox any Linux process using Landlock, no roo... by __turbobrew__ on Sunday March 23, 2025 @04:25PM (#43455634)
> Since the landlock/seccomp filters are at the kernel level

That arguably shows that seccomp is operating at the wrong abstraction level, or the kernel needs another higher level api. With pledge, you operate on capabilities and as new functionality is added to the kernel it is categorized under existing capabilities (for example, if your program pledges not to use networking you can assume that it should not be able to use new networking syscalls added to the kernel in the future).

[ Parent | on HN ]
Re:Landrun: Sandbox any Linux process using Landlock, no roo... by l0kod on Tuesday March 25, 2025 @01:08PM (#43473546)
Seccomp is not an access control system, but Landlock is. Seccomp limits the kernel attack surface and Landlock enforces an access control. They are complementary.

With Landlock, the access control is at the right layer, and the semantic is guaranteed to be the same even if the kernel gets new syscalls. Landlock is the closest thing to Pledge/Unveil we can get with the Linux constraints (and it is gaining new features).

[ Parent | on HN ]