Landlock Workshop: Sandboxing Application for Fun and Protection
summary
Workshop shows how to add Landlock syscalls to a C CLI to confine an old ImageMagick exploit: creates a ruleset with landlock_create_ruleset, adds specific path rules for /usr, /dev, dynamic input file and output directory, then seals it with landlock_restrict_self. The patched convert still executes the exploit but cannot read private keys or user files and can only write to the allowed output dir; demo uses strace, git/vagrant setup and works as a proof of concept.
AI-written summary · about
chapters (14)
- 0:00Landlock sandboxing intro
- 5:11Why sandbox apps
- 7:42How Landlock enforces policies
- 11:42Threat models for sandboxing
- 18:28Landlock with syscalls
- 23:03Patching ImageMagick
- 33:07Testing vulnerable ImageMagick
- 40:44Creating ruleset
- 45:15Adding library exception
- 52:23Dynamic input access
- 57:34Output file permissions
- 1:06:19Final sandboxing results
- 1:09:33Next steps and resources
- 1:14:20Q&A and demo
related talks
37mSandboxing Applications with Landlock
32mLinux Sandboxing with Landlock- 32mLinux Sandboxing with Landlock
36mHow to Safely Restrict Access to Files in a Programmatic Way with Landlock?
40mLandlock Config
38mSandboxing in Linux with zero lines of code
48mUpdate on Landlock: IOCTL Support
01h 02mSandboxing a Linux Application