l0kod

5 ms·

1.
Island: Linux sandboxing tool powered by Landlock(github.com)
3 points by l0kod 10mo ago|1 comments
2.
by l0kod 10mo ago
Island makes Landlock practical for everyday workflows by acting as a high-level wrapper and policy manager. Developed alongside the kernel feature and its Rust libraries, it bridges the gap between raw security mechanisms and user activity
3.
by l0kod 1y ago
Landlock supports scoped abstract UNIX socket: https://docs.kernel.org/userspace-api/landlock.html#ipc-scop... Landlock doesn't use namespaces, they are orthogonal.
4.
by l0kod 1y ago
Seccomp is not an access control system, but Landlock is. Seccomp limits the kernel attack surface and Landlock enforces an access control. They are complementary. With Landlock, the access control is at the right layer, and the semantic is
5.
by l0kod 1y ago
For instance, with Pledge, the "dns" promise is implemented with hardcoded path in the kernel. Linux is complex because it is versatile and flexible. Controlling access to such features requires some complexity and the kernel migh
6.
by l0kod 1y ago
BSD systems ship a kernel and user space, which simplifies a lot of things. Linux is more flexible but it comes at a cost. Adding new security features can also be challenging for other reasons. Anyway, Landlock is one of these new security
7.
by l0kod 1y ago
Namespaces (used by containers) are very powerful but they are also a door to a large attack surface: https://lwn.net/Articles/673597/ Landlock is (only) an access control system, but it's designed to let any
8.
by l0kod 1y ago
It takes time to develop theses features, but Landlock is gaining new network filtering features. We are working in a way to control socket creation according to their protocols, and also a way to filter UDP (which makes sense to developers
9.
by l0kod 1y ago
We are working on a JSON/TOML format for Landlock, with the related library, and bindings for several languages: https://github.com/landlock-lsm/landlockconfig We are working to make it part of the OCI runtime spe
10.
by l0kod 2y ago
Namespace are very useful to build virtual environments, but I think it's important to keep in mind that they are not designed for sandboxing and don't provide security guarantees (e.g. mount point propagation), nor fine-grained a
11.
by l0kod 4y ago
There is an ongoing work to support network access-control: https://lore.kernel.org/all/20220621082313.3330667-1-konstan...