How to Safely Restrict Access to Files in a Programmatic Way with Landlock?
summary
Landlock adds a user-space, unprivileged MAC that identifies files by inode via an eBPF inode map (filled from file descriptors) so sandboxed processes can register per-process rules and update them at runtime. The eighth patch series (Feb) implements chained eBPF programs for path-walk and read/write checks, a demo pins a BPF map, updates it live to grant /etc/passwd and group access, and the sandboxed shell continues without restart. Main caveat: reliance on current pathname lookup semantics and kernel internals. dynamic per-process policies no on-disk xattr changes
AI-written summary · about
chapters (10)
- 0:00Start
- 1:30Features and use cases
- 4:31Demonstration
- 6:58Landlock overview
- 10:34Unprivileged access control
- 13:17Inade's extended attributes
- 23:46Walking through a file path
- 28:39Landlock wrap-up
- 31:41Landlock program's metadata
- 32:05Landlock program code
related talks
37mSandboxing Applications with Landlock
32mLinux Sandboxing with Landlock- 32mLinux Sandboxing with Landlock
40mUpdate on Landlock: Lifting the File Reparenting Limits and Supporting Network Rules
23mUpdate on Landlock: Audit, Debugging and Metrics
01h 17mLandlock Workshop: Sandboxing Application for Fun and Protection
48mUpdate on Landlock: IOCTL Support
42mSandboxing a Linux application