Use landlock on linux 5.13 and higher

Question

Use landlock on linux 5.13 and higher

job opened this issue 3 years ago · comments

Leaving a reminder that perhaps https://landlock.io/ can be used as unveil() replacement on Linux systems

Claudio Jeker · Answer 1 · Thu Aug 04 2022 19:06:54 GMT+0800 (China Standard Time)

Landlock is no where as usable as I would like. Calling it a replacement for unveil() or pledge() is about the same as calling a rusty saw a replacement to a scalpel. It may work for some medical procedures but heck it makes a big mess.

Claudio Jeker · Answer 2 · Tue Aug 09 2022 00:43:20 GMT+0800 (China Standard Time)

Actually since the introduction of unveil(2) in the main process landlock no longer works.
ABI 1 is just not capable, ABI 2 seems to be unobtanium right now.

Claudio Jeker · Answer 3 · Sat Dec 17 2022 00:24:33 GMT+0800 (China Standard Time)

OK, I just committed a workaround for this insanity.
Landlock with ABI 1 must be disabled in the master process.
Landlock with ABI 2 can be used but requires a 5.19 or better 6.X kernel.

We can now consider to merge this into mainline and give some Linux users a little bit more security.

Claudio Jeker · Answer 4 · Tue Feb 28 2023 00:35:46 GMT+0800 (China Standard Time)

Now landlock is not perfect but it is at least something. We decided to merge #70 since it does increase the security of the parser process and that is at least something.