We gave a talk summarizing the #Landlock changes over the last two years, and what's coming next: Observability, process-wide control, networking and more...
https://lsseu2026.sched.com/event/2QmU9
Don't miss the lltop demo recording!
Here is the #Landlock threat model (up-to-date patch): https://lore.kernel.org/all/20260707210336.2060040-1-mic@digikod.net/
This is a follow-up of the recent Linux kernel thread model doc, which should help Landlock users and security researchers, especially with the rise of AI-assisted security reports. 🔒🤖
Just released Island 🏝️, a sandboxing tool powered by #Landlock.
It auto‑confines processes according to the caller's context (e.g. CWD) and comes with slick Zsh integration, so you can use your terminal naturally without command prefixes. Feedback welcome!
https://github.com/landlock-lsm/island
The recording is already online!
https://youtu.be/tZuezmpfwy8
Talking about sandboxing services, I'll give a talk at #AllSystemsGo in a few hours about using #Landlock with systemd: https://cfp.all-systems-go.io/all-systems-go-2025/talk/FXWDCF/
A security model for systemd by @pid_eins at #AllSystemsGo
https://cfp.all-systems-go.io/all-systems-go-2025/talk/FE98ZY/
Script integrity: I gave a talk at #linuxsecuritysummit in Amsterdam on the latest news about Linux's AT_EXECVE_CHECK, useful to check the full file executability (including LSMs' policies), and the two new secbits to incrementally enforce restrictions and really control executable code.
Feel free to let me know if you want to contribute by enlightening your favorite interpreter!
https://lsseu2025.sched.com/event/25GEQ
Starting with Linux 6.14, we'll be able to securely control script execution thanks to new execveat(2) and prctl(2) flags, successors of O_MAYEXEC. This is crucial to fully support code integrity on Linux.
The next step is to enlighten script interpreters. Let me know if you want to help!
https://docs.kernel.org/userspace-api/check_exec.html
It's been a while since the last one, but here is the fourth #Landlock newsletter: https://lore.kernel.org/landlock/20240716.yui4Iezai8ae@digikod.net/
Moar sandboxing! 🥳