Landrun: Sandbox any Linux process using Landlock, no root or containers (github.com)

Article summary

Landrun is a lightweight, secure sandbox for running Linux processes using Landlock, a kernel-native security module. It allows for fine-grained filesystem and network access controls without requiring root or containers. Landrun is designed to be practical and easy to use, with a simple command-line interface and support for various features such as file access, TCP restrictions, and IPC scoping. The tool is auditable and can be integrated with systemd to run services with enhanced security.

Main themes

• Linux security
• Sandboxing
• Landlock
• Systemd integration
• Containerization alternatives
• Filesystem access control

What commenters say

• Landrun provides a more fine-grained and lightweight alternative to existing sandboxing tools like bubblewrap and firejail.
• The use of Landlock as a kernel-native security module provides a more secure and efficient way to sandbox processes compared to user-space tools.
• Some users find the command-line interface and configuration options of Landrun to be confusing or limited, particularly with regards to executable permissions and directory access.
• Landrun's ability to restrict access to specific files and directories is seen as a major advantage over other sandboxing tools, but its lack of support for certain features like abstract UNIX sockets is a limitation.
• The tool's design and implementation are still evolving, with some users suggesting changes to the configuration format and others proposing the use of existing formats like AppArmor or Java's permission system.
• Some users are interested in using Landrun with containers or OCI-compatible interfaces, and there are existing projects that integrate Landlock with containerization mechanisms.
• The trade-off between security and usability is a major concern for users of Landrun, with some prioritizing ease of use and others emphasizing the need for strict access controls and isolation.
• The comparison between Landrun and other sandboxing tools like firejail is complex, with different tools suited to different use cases and requirements.