Update on Landlock: IOCTL Support
summary
Landlock adds explicit IOCTL control by restricting IOCTLs on device files by pathname and permitting a short whitelist of harmless commands (fcntl-like flags, async/buffered IO and filesystem-level ioctls) so drivers cannot be accidentally dispatched; policy construction uses three syscalls: landlock_create_ruleset, landlock_add_rule, landlock_restrict and supports ABI versioning for backward compatibility. Kernel fixes landed for related terminal IOCTL exploits, networking and IPC restrictions (bind/connect, listen, abstract sockets) are in review, and a Go wrapper offers a one-call best‑effort mode for ease of use.
AI-written summary · about
chapters (12)
- 0:00Landlock introduction
- 1:26Sandboxing motivation
- 7:08Why Landlock better
- 9:57Landlock architecture
- 12:01Landlock API explained
- 14:54Landlock operations
- 18:51IOCTL security
- 20:37IOCTL support
- 27:47Recent updates
- 32:33Upcoming features
- 43:27Lightweight use cases
- 48:06Q&A
related talks
40mUpdate on Landlock: Lifting the File Reparenting Limits and Supporting Network Rules
23mUpdate on Landlock: Audit, Debugging and Metrics
32mLinux Sandboxing with Landlock- 32mLinux Sandboxing with Landlock
37mSandboxing Applications with Landlock
36mHow to Safely Restrict Access to Files in a Programmatic Way with Landlock?
40mLandlock Config
01h 17mLandlock Workshop: Sandboxing Application for Fun and Protection