Go-Landlock is a Go library for the Landlock LSM, an unprivileged sandboxing mechanism on Linux.
What is Landlock?
Landlock is a Linux kernel feature and can restrict the following types of access:
- Filesystem access
- Some network operations
- Some IPC operations
TL;DR: Example
In a Go program, after starting up and doing program initialization work, run:
err := landlock.V11.BestEffort().RestrictPaths(
landlock.RODirs("/usr", "/bin"),
landlock.RWDirs("/tmp"),
)After this invocation, your program can only access the specified paths.
Goals
Goals of Go-Landlock are:
- Make unprivileged sandboxing easy to use and effective.
- Keep Go-Landlock's implementation at an easily auditable size.