Landlock LSM Still Tackling Unprivileged Sandboxing For Linux

Written by Michael Larabel in Linux Kernel on 14 September 2016 at 10:37 AM EDT. 8 Comments
LINUX KERNEL
The "Landlock" Linux security module continues to be developed as an effort to let any progress -- even unprivileged processes -- create "powerful security" sandboxes.

The Landlock Linux Security Module (LSM) aims to be comparable to OpenBSD's Pledge or Seabelt/XNU sandboxing approaches. Landlock makes use of cgroups and allows for security rules to be created using the eBPF in-kernel virtual machine.

Landlock is described as differing from SELinux, AppArmor, Smack, and other security modules in that it's not only dedicated to administrators, there is a more limited kernel attack surface, and has other design differences in particularly focusing upon unprivileged processes.

Those wishing to learn more about the current patches for the Landlock module can find this kernel mailing list message. So far it's not been requested by its developers to be mainlined in the Linux kernel.
Related News
About The Author
Michael Larabel

Michael Larabel is the principal author of Phoronix.com and founded the site in 2004 with a focus on enriching the Linux hardware experience. Michael has written more than 20,000 articles covering the state of Linux hardware support, Linux performance, graphics drivers, and other topics. Michael is also the lead developer of the Phoronix Test Suite, Phoromatic, and OpenBenchmarking.org automated benchmarking software. He can be followed via Twitter, LinkedIn, or contacted via MichaelLarabel.com.

Popular News This Week