Sandboxing Applications with Landlock
summary
Landlock is a kernel feature (since Linux 5.13) that lets applications create composable, drop-only sandbox rules around filesystem actions using three syscalls: create a ruleset, add file-keyed rules (read, write, execute, list, remove, create) and restrict_self to enforce them. It enforces nested policies via ruleset file descriptors, prevents changing mount topology or linking across protected directories, and the demo shows even root can be confined. Userspace helpers and Go and Rust libraries exist; current gaps: IPC, network types, and some file operation limitations.
AI-written summary · about
chapters (24)
- 0:00Intro
- 1:40What is it about?
- 2:44State of security for applications nowadays
- 4:41What is (security) sandboxing?
- 5:35Why do we need sandboxing?
- 7:18State of the art
- 8:12Security features available in traditional Linux systems
- 9:51Comparisons of different sandboxing mechanisms
- 15:58What is Landlock?
- 17:16Use cases
- 18:45Current access-control features: filesystem
- 20:37Automatic hierarchy restrictions
- 27:29Interesting development properties
- 28:54Landlock vocabulary
- 29:50How to use Landlock?
- 30:08Create a ruleset
- 30:34Add rules
- 31:20Enforce the ruleset
- 32:02Developer tools
- 32:43Kernel compatibility
- 33:29Backward compatibility
- 34:05Future-proofness
- 35:12Roadmap (kernel-side)
- 36:29Wrap-up
related talks
32mLinux Sandboxing with Landlock- 32mLinux Sandboxing with Landlock
36mHow to Safely Restrict Access to Files in a Programmatic Way with Landlock?
40mLandlock Config
40mUpdate on Landlock: Lifting the File Reparenting Limits and Supporting Network Rules
01h 17mLandlock Workshop: Sandboxing Application for Fun and Protection
38mSandboxing in Linux with zero lines of code
23mUpdate on Landlock: Audit, Debugging and Metrics