this post was submitted on 30 Nov 2025
47 points (100.0% liked)

Linux

10336 readers
653 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 2 years ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
47
Landlock-ing Linux (blog.prizrak.me)
submitted 1 day ago by cm0002@lemmy.cafe to c/linux@programming.dev
7 comments fedilink hide all child comments
 

Landlock: What Is It?

Landlock is a Linux API that lets applications explicitly declare which resources they are allowed to access. Its philosophy is similar to OpenBSD’s unveil() and (less so) pledge(): programs can make a contract with the kernel stating, “I only need these files or resources — deny me everything else if I’m compromised.”

It provides a simple, developer-friendly way to add defense-in-depth to applications. Compared to traditional Linux security mechanisms, Landlock is vastly easier to understand and integrate.

This post is meant to be an accessible introduction, and hopefully persuade you to give Landlock a try.

you are viewing a single comment's thread
view the rest of the comments
[–] boredsquirrel@slrpnk.net 10 points 1 day ago (1 children)

https://codeberg.org/crabjail

Here is a sandboxing tool using that feature

[–] The_Decryptor@aussie.zone 2 points 1 day ago

Landrun as well, takes the restrictions on the command line. Can look messy, but does make it entirely standalone, so you can e.g. drop it into a service file as the readme shows easily enough.