Skip to content

Comment on Landlock-Ing Linuxparent

Comments

You can restrict the landlock syscalls with seccomp.

I also don't think doing so is extraordinarily useful.

If you allow something in landlock, it's still subject to traditional DAC and other restrictions because its a stackable LSM. It can only restrict existing access, not allow new accesses.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.