I want to craft an environment where any program trying to read f.ex. anything inside ~/.ssh is automatically denied
That requires a MAC security model like apparmor [0] or selinux [1]. Those can deny filesystem access based on process environment data, such as the executable path or its security context. But these require the access rules to be enumerated externally, whereas landlock is about an application voluntarily limiting itself -- or limiting its children: e.g. it would be a very good idea for npm to restrict the scope of package post-install scripts to only the npm cache/build tree.
It seems that this software is well-positioned for us to write application launchers
Like OpenBSD's pledge[2], this API is primarily meant for application writers, not launchers. But where the Openbsd base system is maintained as a whole by the same group of people, Linux is a hodgepodge of different distributions using various software to construct a complete system. This means it's going to take a long while before landlock will reach anywhere close to the same coverage that pledge already has in OpenBSD. In the meantime, wrappers/launchers is the best that you can do on Linux.
When I said launchers, I meant more like f.ex. my own bespoke mini Golang program that lists rules inside its via Landlock's DSL and then launches f.ex. Firefox.
But maybe that's unnecessary because I hear that Flatpak has a big database of such rules already. I'll find out in the future.
Comments
I want to craft an environment where any program trying to read f.ex. anything inside ~/.ssh is automatically denied
That requires a MAC security model like apparmor [0] or selinux [1]. Those can deny filesystem access based on process environment data, such as the executable path or its security context. But these require the access rules to be enumerated externally, whereas landlock is about an application voluntarily limiting itself -- or limiting its children: e.g. it would be a very good idea for npm to restrict the scope of package post-install scripts to only the npm cache/build tree.
It seems that this software is well-positioned for us to write application launchers
Like OpenBSD's pledge[2], this API is primarily meant for application writers, not launchers. But where the Openbsd base system is maintained as a whole by the same group of people, Linux is a hodgepodge of different distributions using various software to construct a complete system. This means it's going to take a long while before landlock will reach anywhere close to the same coverage that pledge already has in OpenBSD. In the meantime, wrappers/launchers is the best that you can do on Linux.
[0] https://en.opensuse.org/SDB:AppArmor_geeks#Anatomy_of_a_prof...
[1] https://manpages.opensuse.org/Tumbleweed/selinux-policy-doc/...
[2] https://unix.stackexchange.com/a/411157
Thank you, that was super useful.
When I said launchers, I meant more like f.ex. my own bespoke mini Golang program that lists rules inside its via Landlock's DSL and then launches f.ex. Firefox.
But maybe that's unnecessary because I hear that Flatpak has a big database of such rules already. I'll find out in the future.