Landlock Access Controls Extended To Networking With Linux 6.7

Landlock was merged back in 2021 with Linux 5.13 for unprivileged application sandboxing. Landlock is focused on restricting ambient rights and is implemented as a stackable Linux security module (LSM). With Linux 6.7 the Landlock LSM is now moving beyond just file-system access controls to also introduce initial networking support.

The Landlock code for Linux 6.7 adds new LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP access rights.

This new support in Landlock ABI version 3 allows restricting TCP sockets bind() and connect() system calls for specific ports. Currently the Landlock network support is limited to TCP with there being complications around UDP but that still may end up supporting UDP sockets in the future.

Those wanting to learn more about the Landlock networking support being added in Linux 6.7 can see this pull request. Those wanting to learn more about this Linux access control mechanism in general can find the documentation at Landlock.io.