Still In Development, Landlock Aims To Yield Powerful Security Sandboxes For Linux

The Landlock Linux Security Module (LSM) continues to be in development and has now been revised for its seventh time. The last time we wrote about this LSM was last September while over the weekend the newest patches have surfaced.

Landlock's goal is to "allow any process, including unprivileged ones, to create powerful security sandboxes comparable to XNU Sandbox or OpenBSD Pledge. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user-space applications."

Landlock is making use of eBPF as the security policy language rather than coming up with its own language like in SELinux or AppArmor.

Linux administrators wishing to learn more about the continued work on the Landlock security module can find the v7 patches on the kernel mailing list.