Still In Development, Landlock Aims To Yield Powerful Security Sandboxes For Linux

[phoronix]

Phoronix: Still In Development, Landlock Aims To Yield Powerful Security Sandboxes For Linux

The Landlock Linux Security Module (LSM) continues to be in development and has now been revised for its seventh time. The last time we wrote about this LSM was last September while over the weekend the newest patches have surfaced...

http://www.phoronix.com/scan.php?page=news_item&px=Landlock-LSM-v7-Linux

[Michael_S]

I had to search what eBPF means, I think it's extended Berkeley Packet Filter. If everyone else knew that already, then sorry for my ignorance.

So really the big innovation here is to let non-root users set up application sandboxes? I thought Snappy, Flatpak, AppImage, etc... facilitated that? Or do you still need root to install all of them?

[Jabberwocky]

I hope it takes less time to study compared to SELinux/AppArmor (from a user's perspective).

[unixfan2001]

I had to search what eBPF means, I think it's extended Berkeley Packet Filter. If everyone else knew that already, then sorry for my ignorance.

So really the big innovation here is to let non-root users set up application sandboxes? I thought Snappy, Flatpak, AppImage, etc... facilitated that? Or do you still need root to install all of them?

Neither Flatpak, nor Snappy, nor AppImage let non-root users set up sandboxes.
That's done by an SUID helper. Usually Bubblewrap (Flatpak and Snappy both use that one), in the case of AppImage Bubblewrap or Firejail.

[Michael_S]

Neither Flatpak, nor Snappy, nor AppImage let non-root users set up sandboxes.
That's done by an SUID helper. Usually Bubblewrap (Flatpak and Snappy both use that one), in the case of AppImage Bubblewrap or Firejail.

Thanks. I didn't know.