Landlock: unprivileged access-control
The goal of Landlock is to enable to restrict ambient rights (e.g. global
filesystem access) for a set of processes. Because Landlock is a stackable
LSM, it makes possible to create safe security sandboxes as new security layers
in addition to the existing system-wide access-controls. This kind of sandbox
is expected to help mitigate the security impact of bugs or
unexpected/malicious behaviors in user-space applications. Landlock empower any
process, including unprivileged ones, to securely restrict themselves.
Summary 2019
Landlock: a new kind of Linux Security Module leveraging eBPF
[PATCH v10]
Landlock LSM: toward unprivileged sandboxing
[PATCH v9]
Landlock LSM: toward unprivileged sandboxing
Linux Security Summit 2018
How to safely restrict access to files in a programmatic way with Landlock?
Pass the SALT 2018
Internals of Landlock: a new kind of Linux Security Module leveraging eBPF
[PATCH v8]
Landlock LSM: toward unprivileged sandboxing
FOSDEM 2018
File access-control per container with Landlock
Linux Security Summit 2017
Landlock LSM: toward unprivileged sandboxing
[PATCH v7]
Landlock LSM: toward unprivileged sandboxing