search

igo95862 / bubblejail

Bubblewrap based sandboxing for desktop applications
244 stars 17 forks source link

Add support for landlock LSM #45

Open igo95862 opened 1 year ago

igo95862 commented 1 year ago

Description

https://www.kernel.org/doc/html/latest/userspace-api/landlock.html

Landlock is an unprivileged LSM. It is already compiled in Arch Linux.

For bubblejail it makes sense to restrict write permission outside the instance home and run directory.

rusty-snake commented 1 year ago

For bubblejail it makes sense to restrict write permission outside the instance home and run directory.

It can also be used for W^X in the filesystem.