go-landlock

Its a way for legitimate apps to add an extra protection layer to protect the system from bad inputs or compromised dependencies, and it's very easy to use (see https://github.com/landlock-lsm/go-landlock). As an app developer it's so easy to add landlock to your app. Another benefit is that it makes it easier for fine-grain control of resources in the application lifecycle. Maybe on initialization the app needs credentials to fetch some data and later on the all doesnt need them. Landlock allows the app to remove its own access to those credentials.

I feel like I need to ask; did you write this comment and the code example yourself, or did you ask an AI to generate it? If it's AI, why didn't you disclose it? If it's the former, why the weird formatting etc instead of linking to one of the official examples at https://github.com/landlock-lsm/go-landlock/blob/main/exampl... ?

Firejail requires SUID, LandLock does not. Also, it's very easy to write your own LandLock policy in the programming language of your choice and wrap whatever program you like rather than downloading stuff from Github. Here's another example in Go: package main import ( "fmt" "github.com/landlock-lsm/go-landlock/landlock" "log" "os" "os/exec" ) func main() { // Define the LandLock policy err := landlock.V1.RestrictPaths(...) // Execute FireFox cmd := exec.Command("/usr/bin/firefox") }

LandLock is a Minor LSM intended for software developers. They incorporate it into their source code to limit where the programs may read/write. Here's a simple Go example: package main import ( "flag" "fmt" "github.com/landlock-lsm/go-landlock/landlock" "io/ioutil" "log" "os" ) // simple program that demonstrates how landlock works in Go on Linux systems. // Requires 5.13 or newer kernel and .config should look something like this: // CONFIG_SECURITY_LANDLOCK=y // CONFIG_LSM="landlock,lockdown,yama,loadpin,safesetid,integrity,apparmor,selinux,smack,tomoyo" func main() { var help = flag.Bool("help", false, "landlock-example -f /path/to/file.txt") var file = flag.String("f", "", "the file path to read") flag.Parse() if *help || len(os.Args) == 1 { fl

It's tracked in https://github.com/landlock-lsm/go-landlock/issues/35 - signals and abstract Unix sockets do unfortunately not interact well with the inherently multithreaded Go runtime. We are working on a fix in https://github.com/landlock-lsm/go-landlock/issues/36 but this needs to be on the kernel side and this is delaying this feature in Go, unfortunately. It is usable from (single threaded) C programs though.

OpenBSD did get it right, but they also have a more relaxed scheme for backwards compatibility across releases. Linux's strict ABI compatibility guarantees complicate matters slightly, but with the right supporting library it becomes tolerable. See the example at the top of the Readme at https://github.com/landlock-lsm/go-landlock (Full disclosure, I am the author of that library) FWIW, I do hope that we can motivate people to use Landlock in the same way as people use pledge on OpenBSD, as a lightweight self-sandboxing mechanism that requires fewer architectural changes to your program and results in more constrained sandboxes than Linux namespaces and other mechanisms do.

(Author of that library here) It is a library, as already linked in the other comment: https://github.com/landlock-lsm/go-landlock The landrun tool is built on the same library. We also provide an official library for Rust, and obviously you can do it from C as well. I also collected some libraries for other languages at https://wiki.gnoack.org/SoftwareUsingLandlock (but I can not vouch for their quality in detail)

I agree that re-use file format could a good option. BTW the used landlock go library has sort of example https://github.com/landlock-lsm/go-landlock/blob/main/exampl...

The underlying library that does most of the work is MIT. https://github.com/landlock-lsm/go-landlock

+1, escalating privileges in order to drop privileges is counterintuitive and risky. This was the best possible solution for a while, but things are getting better with Landlock introducing unprivileged sandboxing for file accesses. There are helper libraries in Go and Rust at https://github.com/landlock-lsm, and it's easy to play around with it with the landlock-restrict example tool: $ go install github.com/landlock-lsm/go-landlock/cmd/landlock-restrict@latest $ mkdir /tmp/lolcat $ HOME=/tmp/lolcat landlock-restrict -ro /usr /lib /etc -rw /tmp/lolcat -- /bin/bash The web browser I'm writing this from is sandboxed using the same example tool, so this works for bigger software as well. :) (Full disclosure, I'm the author of the go-landlock library.) I'm having high hopes that this'll get used by a lot of other sandboxing software a