Create accountLogin

Recent searches

No recent searches

Search options

Only available when logged in.
mastodon.social is one of the many independent Mastodon servers you can use to participate in the fediverse.
The original server operated by the Mastodon gGmbH non-profit

Administered by:

Server stats:

338K
active users

mastodon.social: AboutStatusProfiles directoryPrivacy policy

Mastodon: AboutGet the appKeyboard shortcutsView source codev4.4.0-nightly.2025-04-15

#landlock

0 posts0 participants0 posts today
Public
Joachim Weber [friendica] 🦖 🦔 🐲
Im Kernel gibt es schon seit einiger Zeit das Landlock-Modul, über das sich normale Programme selbst gezielt einige (Zugriffs-)Rechte entziehen können. Diese Möglichkeiten nutzt das Tool Landlock, um andere Prozesse in ein Gefängnis zu sperren.#Landlock #Landrun #Sandbox
Landrun sperrt Prozesse performant mit Landlock ein - LinuxCommunity
LinuxCommunity · Landrun sperrt Prozesse performant mit Landlock ein - LinuxCommunityIm Kernel gibt es schon seit einiger Zeit das Landlock-Modul, über das sich normale Programme selbst gezielt einige (Zugriffs-)Rechte entziehen können. Diese Möglichkeiten nutzt das Tool Landlock, um andere Prozesse in ein Gefängnis zu sperren. Landrun übergibt man einen Kommandozeilenbefehl, den das Werkzeug stellvertretend startet. Dabei verwehrt es dem entstehenden Prozess den Zugriff auf ausgewählte Verzeichnisse und das Netzwerk. Auf diese Weise lassen sich unter anderem aus dem Internet heruntergeladene Programme etwas sicherer auf dem eigenen System ausprobieren. Da Landrun im Hintergrund Landlock nutzt, benötigt das Werkzeug weder Root-Rechte noch ein anderes komplexes Sicherheits-Framework wie SELinux oder AppArmor. Darüber hinaus laufen die Prozesse mit voller Kraft – anders als bei Containern gibt es keine Zwischenschicht oder eine umständliche Konfiguration. Allerdings gibt es noch eine wichtige Einschränkung: Derzeit greift Landrun auf die Fähigkeiten von Landlock v5 zurück. Damit kann das Tool lediglich den Zugriff auf Dateien und TCP-Verbindungen blocken. Der Entwickler treibt sein junges Projekt aber recht flott voran. Die aktuelle Version 0.1.14 führt etwa neue Parameter ein, über die sich die Integration von dynamischen Bibliotheken besser steuern lassen.
Replied in thread
Public
r1w1s1
Yes, #slackware current includes #Landlock support in the testing group with #kernel 6.14.
However, you must enable it at boot. If you're using #GRUB, follow these steps:

1. Add the following line to /etc/default/grub:

GRUB_CMDLINE_LINUX_DEFAULT="lsm=landlock"

2. Regenerate the GRUB configuration:

geninitrd

3. Reboot your system and verify that Landlock is enabled:

sudo dmesg | grep landlock

Example output:

[ 0.000000] Command line: BOOT_IMAGE=/boot/vmlinuz-generic root=UUID=... ro lsm=landlock
[ 0.068388] Kernel command line: BOOT_IMAGE=/boot/vmlinuz-generic root=UUID=... ro lsm=landlock
[ 0.212270] LSM: initializing lsm=capability,landlock
[ 0.212270] landlock: Up and running.

Once enabled, you can use landrun on Slackware-current:
https://slackbuilds.org/repository/15.0/network/landrun/
slackbuilds.orgSlackBuilds.org - landrunSlackBuilds.org - SlackBuild Script Repository
Public
r1w1s1


Another LSM we don't talk enough about
https://github.com/Zouuup/landrun

The landlock LSM isn't frequently spoken about, it's Linux equivalent of OpenBSD unveil. See also "Following landlock development" in 204, "Landlock" in 161 among others. Or what I've written about it.(https://venam.net/blog/unix/2023/02/28/access_control.html#landlock--seccomp)

Love Linux/Unix? Subscribe to the Nixers Newsletter: https://newsletter.nixers.net/entries.php !
#landlock #landrun #linux #openbsd
Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel. - Zouuup/landrun
GitHubGitHub - Zouuup/landrun: Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel. - Zouuup/landrun
Public
r1w1s1 :slackware:

Linux 6.14 changelog.
kernelnewbies.org/Linux_6.14

I'm really looking forward to #Slackware current ship #kernel 6.14. I'm especially interested in Landlock, and to take advantage of it, I'll compile my own kernel, a task I've mastered over the past decade... or
so I thought. Apparently, Slackware's philosophy is 'if you're not compiling a kernel, are you even really living?'
So, back to the make mines I go!

Then, I'll be running Landrun (github.com/Zouuup/landrun)

kernelnewbies.orgLinux_6.14 - Linux Kernel NewbiesSummary of the changes and new features merged in the Linux kernel during the 6.14 development cycle
#landrun#landlock
Public
GripNews

🌘 在安全的、非特權沙盒中運行任何 Linux 進程，使用 Landlock LSM。<br>
➤ Landlock LSM 提供安全的 Linux 沙盒環境。<br>
✤ github.com/Zouuup/landrun
這篇文章介紹了針對 Linux 進程運行的 Landlock LSM 安全沙盒，類似 firejail，但更輕巧、用戶友好並融入內核。<br>
+ 這篇文章提供了清晰的說明，讓人對 Landlock LSM 的安全功能有更深入的瞭解。<br>
+ 使用 Landlock LSM 在 Linux 上運行進程看起來是一個很有前景的方向，希望以後能看到更多相關的應用場景。
LSM<br>

Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel. - Zouuup/landrun
GitHubGitHub - Zouuup/landrun: Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel.Run any Linux process in a secure, unprivileged sandbox using Landlock. Think firejail, but lightweight, user-friendly, and baked into the kernel. - Zouuup/landrun
Public
alip

Regarding latest #landlock #cve which is still under analysis, #sydbox prevents unknown files (and files referring to block devices) from being listed and opened, see gitlab.exherbo.org/sydbox/sydb and gitlab.exherbo.org/sydbox/sydb, the #cve is here, nvd.nist.gov/vuln/detail/CVE-2 So far the only false positive we had is pipewire passing files of unknown types thru unix sockets so we relaxed that but we still do disallow passing dirfds like #openbsd and add to that symlinkfds and blockdevfds #exherbo #security

GitLabsrc/hook.rs · main · Sydbox / sydbox · GitLabrock-solid application kernel
Public
n0toose

I'd like to share something nice that I am currently working on: A Landlock integration for Forgejo.

Landlock (landlock.io) lets userspace processes tell the kernel "hey kernel, please only let me access the following filesystem resources" (and it also supports sockets, etc. now).

My integration only limits unfettered access to arbitrary files. It needs a lot more yak shaving (refactoring, configurations, using the PATH variable for Git binaries) and time.

Screenshot of a Forgejo instance running Landlock. The screenshot contains a repository in Forgejo with a README file. Title: landlock-test Description: This repository was created using a Forgejo instance that is protected under Landlock, which limits unfettered access to paths and binaries on the system running Forgejo. This is a heavy proof of concept and needs much further work to be integrated reliably.
#landlock#forgejo
Public
Christoph
So getting #landlock -ed #snac to work on #alpine is more involved than I thought...
When tracing syscalls and setting CURLOPT_VERBOSE, no failed syscalls show up on any network request... Also, curl is compiled with c-ares on alpine, but that still should only require /etc/resolv.conf and /etc/hosts.
Not sure where to continue debugging...
Public
Morten Linderud

If anyone is interested in contributing to ssh-tpm-agent I've written up the remaining issues before a 1.0.0 release.

Largely about #landlock support, using the kernel keyring for PIN caching, and writing up man pages for all the tools.

github.com/Foxboron/ssh-tpm-ag

Probably a good opportunity to learn more about TPMs and ssh for those interested!

:computer: :key: ssh-agent for TPMs. Contribute to Foxboron/ssh-tpm-agent development by creating an account on GitHub.
GitHubGitHub - Foxboron/ssh-tpm-agent: :computer: ssh-agent for TPMs:computer: :key: ssh-agent for TPMs. Contribute to Foxboron/ssh-tpm-agent development by creating an account on GitHub.
#TPM#Golang#Go
ExploreLive feeds
About