prizrak.me blog
blog.prizrak.me

Landlock: What Is It?

Landlock is a Linux API that lets applications explicitly declare which resources they are allowed to access. Its philosophy is similar to OpenBSD’s unveil() and (less so) pledge(): programs can make a contract with the kernel stating, “I only need these files or resources — deny me everything else if I’m compromised.”

It provides a simple, developer-friendly way to add defense-in-depth to applications. Compared to traditional Linux security mechanisms, Landlock is vastly easier to understand and integrate.

This post is meant to be an accessible introduction, and hopefully persuade you to give Landlock a try.

  • JakenVeina@midwest.social
    13·
    15 hours ago

    So, it’s a way for applications to make themselves more hardened against exploitation? Was really confused on first reading the title, but that makes some sense. Applications declare what permissions they need, up-front, so any exploits during normal operation can only operate under that umbrella. Unless the startup processes of the application itself are exploited.