LWN: Comments on "Sandboxing with the Landlock security module"

Sandboxing with the Landlock security module

filssavi — Fri, 28 Oct 2016 15:35:50 +0000

that effectively makes more sense now

Sandboxing with the Landlock security module

Wol — Thu, 27 Oct 2016 17:27:24 +0000

Because it can't?

As I read it, you set up the environment, then run the program inside the environment.

So no process can "reach out" to another process that's already running. You would need to intercept the login process and restrict that.

Cheers,
Wol

Sandboxing with the Landlock security module

filssavi — Thu, 27 Oct 2016 07:42:40 +0000

So if an unprivileged user's process can (more or less arbitrarily) limit the capabilities of any other process from that user, what stops a compromised pice of code from trashing the system by overlimiting any existing process from the same user?

Sandboxing with the Landlock security module

l0kod — Wed, 26 Oct 2016 14:12:02 +0000

RFC v4: https://www.mail-archive.com/netdev@vger.kernel.org/msg13...
Associated repository: https://github.com/l0kod/linux/commits/landlock-v4

Sandboxing with the Landlock security module

l0kod — Thu, 20 Oct 2016 14:09:56 +0000

Firejail use Linux namespaces and seccomp-bpf. Landlock is a (low level) kernel feature similar to seccomp-bpf. Landlock should then be useful to sandbox managers like Firejail or any other software willing to do sandboxing (e.g. web browser).

Sandboxing with the Landlock security module

corbet — Thu, 20 Oct 2016 13:33:19 +0000

LSM hooks are purely restrictive - they can reduce access, but cannot increase it. So, unless there's a bug somewhere, an attacker cannot escape by attaching more programs.

Sandboxing with the Landlock security module

gutschke — Thu, 20 Oct 2016 06:17:58 +0000

If it's anything like how seccomp-BPF works, then programs are indeed stackable, but each additional program can only serve to narrow permissions. And no, once a BPF program has been attached, it cannot be removed.

Sandboxing with the Landlock security module

fredrik — Thu, 20 Oct 2016 06:05:44 +0000

How does this compare to firejail?

https://firejail.wordpress.com/

Sandboxing with the Landlock security module

JdGordy — Thu, 20 Oct 2016 03:15:24 +0000

Maybe I'm misunderstanding, if the BPF program doesn't need root to be attached, what's to stop an attacker just attaching a new BPF to get out of the sandbox once the sandboxed program is exploited?