Update on Landlock: Audit, Debugging and Metrics
summary
Landlock adds auditable denied-access logs via the Linux audit framework, showing rule-set id 1 creating domain id 2 and explicit EACCES (errno 13) denies with the exact missing file permissions (e.g., FM_LAYOUT) and the target path. Demo uses the sandbox from samples to create readable and writable path sets; logs show open/exec/ptrace denies, nested policies, and why /dev/tty or / was blocked. Work-in-progress adds freeze/restore with reproduced domain/ruleset IDs and a new debug filesystem; patches are submitted to mainline.
AI-written summary · about
chapters (6)
- 0:00Landlock sandboxing intro
- 3:15Landlock auditing goals
- 6:27Logging design challenges
- 9:18Live demo: audit logs
- 15:47Missing features & future
- 20:29Roadmap & feedback
related talks
40mUpdate on Landlock: Lifting the File Reparenting Limits and Supporting Network Rules
37mSandboxing Applications with Landlock
36mHow to Safely Restrict Access to Files in a Programmatic Way with Landlock?
32mLinux Sandboxing with Landlock- 32mLinux Sandboxing with Landlock
40mLandlock Config
48mUpdate on Landlock: IOCTL Support
26mContainers: Your Ally in Improving Security