Landlock Config
summary
Landlock Config defines a concrete, composable policy format implemented as JSON and TOML files plus a Rust library with C bindings that parses, composes and downgrades Landlock ABI versions deterministically. Variables hold lists of paths, snippets merge without order dependence, and an example sandboxer binary already runs policies from multiple files. Kernel compatibility and composition rules aim to prevent silent breaks; microbenchmarks show roughly 5–15% open() overhead in worst cases while typical desktop use is negligible, and the project is published under the LASM GitHub.
AI-written summary · about
chapters (11)
- 0:00Landlock and sandboxing intro
- 2:52Why sandbox with Landlock
- 5:23Sandbox without code changes
- 10:00Need for new config format
- 12:29JSON and TOML formats
- 15:24Config format key properties
- 19:39Variables and composition
- 22:38Config composition example
- 27:41Implementation details
- 30:33Future plans and community
- 31:22Q&A
related talks
37mSandboxing Applications with Landlock
32mLinux Sandboxing with Landlock- 32mLinux Sandboxing with Landlock
40mUpdate on Landlock: Lifting the File Reparenting Limits and Supporting Network Rules
23mUpdate on Landlock: Audit, Debugging and Metrics
01h 17mLandlock Workshop: Sandboxing Application for Fun and Protection
48mUpdate on Landlock: IOCTL Support
36mHow to Safely Restrict Access to Files in a Programmatic Way with Landlock?