landlock-lsm/go-landlock
View on GitHub ↗ ★ 369 Go
A Go library for the Linux Landlock sandboxing feature
12 mentions on Hacker News by 8 people: 1 story, 11 comments · first 2022-03-27 · latest 2025-11-30
20082026
-
…to protect the system from bad inputs or compromised dependencies, and it's very easy to use (see https://github.com/landlock-lsm/go-landlock ). As an app developer it's so easy to add landlock to your app. Another benefit is that it makes…
comment by myaccountonhn · 2025-11-30 · in Landlock-Ing Linux -
…it's the former, why the weird formatting etc instead of linking to one of the official examples at https://github.com/landlock-lsm/go-landlock/blob/main/exampl... ?
comment by Cthulhu_ · 2025-11-29 · in Landlock-Ing Linux -
…like rather than downloading stuff from Github. Here's another example in Go: package main import ( "fmt" "github.com/landlock-lsm/go-landlock/landlock" "log" "os" "os/exec" ) func main() { // Define the LandLock policy err :=…
comment by seethishat · 2025-11-29 · in Landlock-Ing Linux -
…to limit where the programs may read/write. Here's a simple Go example: package main import ( "flag" "fmt" "github.com/landlock-lsm/go-landlock/landlock" "io/ioutil" "log" "os" ) // simple program that demonstrates how landlock works in Go…
comment by seethishat · 2025-11-29 · in Landlock-Ing Linux -
It's tracked in https://github.com/landlock-lsm/go-landlock/issues/35 - signals and abstract Unix sockets do unfortunately not interact well with the inherently multithreaded Go runtime. We are working on a fix in…
comment by gnoack · 2025-03-23 · in Landrun: Sandbox any Linux process using Landlock, no root or containers -
…with the right supporting library it becomes tolerable. See the example at the top of the Readme at https://github.com/landlock-lsm/go-landlock (Full disclosure, I am the author of that library) FWIW, I do hope that we can motivate people…
comment by gnoack · 2025-03-22 · in Landrun: Sandbox any Linux process using Landlock, no root or containers -
(Author of that library here) It is a library, as already linked in the other comment: https://github.com/landlock-lsm/go-landlock The landrun tool is built on the same library. We also provide an official library for Rust, and obviously…
comment by gnoack · 2025-03-22 · in Landrun: Sandbox any Linux process using Landlock, no root or containers -
…that re-use file format could a good option. BTW the used landlock go library has sort of example https://github.com/landlock-lsm/go-landlock/blob/main/exampl...
comment by bastiao · 2025-03-22 · in Landrun: Sandbox any Linux process using Landlock, no root or containers -
The underlying library that does most of the work is MIT. https://github.com/landlock-lsm/go-landlock
comment by allset_ · 2025-03-22 · in Landrun: Sandbox any Linux process using Landlock, no root or containers -
https://pkg.go.dev/github.com/landlock-lsm/go-landlock/landl...
comment by NewJazz · 2025-03-22 · in Landrun: Sandbox any Linux process using Landlock, no root or containers -
…, and it's easy to play around with it with the landlock-restrict example tool: $ go install github.com/landlock-lsm/go-landlock/cmd/landlock-restrict@latest $ mkdir /tmp/lolcat $ HOME=/tmp/lolcat landlock-restrict -ro /usr /lib /etc -rw…
comment by gnoack · 2022-03-27 · in Firejail: Linux namespaces and seccomp-bpf sandbox