Linux Sandboxing with Landlock
summary
Landlock enables unprivileged policy creation so a process defines a deny-by-default set, adds explicit exceptions via file-descriptor-based rules, then calls the kernel to enforce the policy; enforcement is irreversible and inherits to all children, so escape through setuid binaries or later changes is prevented. Landlock already appears in many distributions, has tooling (setuid-free sandboxes and libs like bubblewrap/firejail integrations), and is gaining network and IPC controls while remaining testable in CI against supported ABI versions.
AI-written summary · about
chapters (10)
- 0:00The need for sandboxing
- 2:39Existing security mechanisms
- 7:41Introducing Landlock
- 10:48Landlock use cases
- 14:32How Landlock works
- 16:41Implementing Landlock
- 19:25Adoption and ecosystem
- 22:10Security insights and tests
- 24:31Future roadmap and contribution
- 26:46Q&A session
related talks
32mLinux Sandboxing with Landlock
37mSandboxing Applications with Landlock
36mHow to Safely Restrict Access to Files in a Programmatic Way with Landlock?
40mLandlock Config
40mUpdate on Landlock: Lifting the File Reparenting Limits and Supporting Network Rules
01h 17mLandlock Workshop: Sandboxing Application for Fun and Protection
23mUpdate on Landlock: Audit, Debugging and Metrics
38mSandboxing in Linux with zero lines of code