View Issue Details
ID | Project | Category | View Status | Date Submitted | Last Update |
---|---|---|---|---|---|
0007987 | Rocky-Linux-9 | kernel | public | 2024-10-09 13:43 | 2025-04-09 17:44 |
Reporter | Mickaël Salaün | Assigned To | Louis Abel | ||
Priority | normal | Severity | feature | Reproducibility | always |
Status | closed | Resolution | no change required | ||
Summary | 0007987: Enable Landlock | ||||
Description | Landlock is a feature to create security sandboxes thanks to 3 dedicated system calls. They are designed to be safe to used by any processes, which can only drop their privileges, similarly to seccomp. The Landlock LSM needs to be build in the kernel (CONFIG_SECURITY_LANDLOCK=y) and enabled by default (CONFIG_LSM=landlock,...) to be useful (supported since Linux 5.13). See https://docs.kernel.org/userspace-api/landlock.html#kernel-support Landlock is already enabled by default on Ubuntu 22.04 LTS, Fedora 35, Arch Linux, Alpine Linux, Gentoo, Debian, chromeOS, and more. There is an opened ticket for RHEL but no real activity since two years (see RHBZ: 2103989): https://issues.redhat.com/browse/RHEL-8810 Because the goal of sandboxing is to be seamlessly integrated in applications/services and work in a best-effort mode (see https://sched.co/1ej3a), no specific user space configuration is needed to leverage Landlock. Landlock should be enabled on Rock Linux 9 and 10. | ||||
Tags | No tags attached. | ||||
Just adding a short note in case someone is interested. Landlock is now enabled in ELRepo's kernel-ml and kernel-lt: https://elrepo.org/bugs/view.php?id=1486 |
|
Thank you for the report. Landlock will be enabled in Rocky Linux 10 as it is enabled in CentOS Stream 10. Landlock will likely land in 9.6. As an alternative, you may use the elrepo kernels. Closing. |
|
Date Modified | Username | Field | Change |
---|---|---|---|
2024-10-09 13:43 | Mickaël Salaün | New Issue | |
2024-10-19 19:43 | Akemi Yagi | Note Added: 0008548 | |
2025-04-09 17:44 | Louis Abel | Assigned To | => Louis Abel |
2025-04-09 17:44 | Louis Abel | Status | new => closed |
2025-04-09 17:44 | Louis Abel | Resolution | open => no change required |
2025-04-09 17:44 | Louis Abel | Note Added: 0009786 |