Update on Landlock: Lifting the File Reparenting Limits and Supporting Network Rules
summary
Landlock is in mainline since kernel 5.13 and gains a new file refer right that lets renames and links work without policy bypass by requiring LANDLOCK_ACCESS_FS_REFER on source and destination and checking the destination’s rights are a subset of the source; a demo shows preserved inode renames. Policy layering supports 16 nested sandboxes. A new ABI flag lets apps detect features. Networking adds per-port rules with tcp_connect / tcp_bind actions (demo enforces bind 2000 and connect 3000 successfully).
AI-written summary · about
chapters (12)
- 0:00Introduction
- 3:47Important News
- 9:39Lifting File Reparenting Limits
- 10:26Challenges
- 11:55Landlock Process Composition
- 15:59File Reparenting Limitations
- 16:58Current Network Rules
- 19:26Access Control Types
- 25:03EAccess and XDev
- 26:42Landlock API Version
- 27:41Network Rules
- 29:27Demo
related talks
37mSandboxing Applications with Landlock
48mUpdate on Landlock: IOCTL Support
32mLinux Sandboxing with Landlock- 32mLinux Sandboxing with Landlock
36mHow to Safely Restrict Access to Files in a Programmatic Way with Landlock?
23mUpdate on Landlock: Audit, Debugging and Metrics
40mLandlock Config
01h 17mLandlock Workshop: Sandboxing Application for Fun and Protection