 |
Just adding a short note in case someone is interested. Landlock is now enabled in ELRepo's kernel-ml and kernel-lt: https://elrepo.org/bugs/view.php?id=1486 |
- Anonymous
| ID | Project | Category | View Status | Date Submitted | Last Update |
|---|---|---|---|---|---|
| 0007987 | Rocky-Linux-9 | kernel | public | 2024-10-09 13:43 | 2024-10-19 19:43 |
| Reporter | Mickaël Salaün | Assigned To | |||
| Priority | normal | Severity | feature | Reproducibility | always |
| Status | new | Resolution | open | ||
| Summary | 0007987: Enable Landlock | ||||
| Description | Landlock is a feature to create security sandboxes thanks to 3 dedicated system calls. They are designed to be safe to used by any processes, which can only drop their privileges, similarly to seccomp. The Landlock LSM needs to be build in the kernel (CONFIG_SECURITY_LANDLOCK=y) and enabled by default (CONFIG_LSM=landlock,...) to be useful (supported since Linux 5.13). See https://docs.kernel.org/userspace-api/landlock.html#kernel-support Landlock is already enabled by default on Ubuntu 22.04 LTS, Fedora 35, Arch Linux, Alpine Linux, Gentoo, Debian, chromeOS, and more. There is an opened ticket for RHEL but no real activity since two years (see RHBZ: 2103989): https://issues.redhat.com/browse/RHEL-8810 Because the goal of sandboxing is to be seamlessly integrated in applications/services and work in a best-effort mode (see https://sched.co/1ej3a), no specific user space configuration is needed to leverage Landlock. Landlock should be enabled on Rock Linux 9 and 10. | ||||
| Tags | No tags attached. | ||||
|
|
Just adding a short note in case someone is interested. Landlock is now enabled in ELRepo's kernel-ml and kernel-lt: https://elrepo.org/bugs/view.php?id=1486 |
| Date Modified | Username | Field | Change |
|---|---|---|---|
| 2024-10-09 13:43 | Mickaël Salaün | New Issue | |
| 2024-10-19 19:43 | Akemi Yagi | Note Added: 0008548 |