5 releases (3 breaking)
0.4.0 | Jun 19, 2024 |
---|---|
0.3.1 | Mar 26, 2024 |
0.3.0 | Oct 10, 2023 |
0.2.0 | Jan 30, 2023 |
0.1.0 | Apr 14, 2021 |
#45 in Unix APIs
139,787 downloads per month
Used in 15 crates
(4 directly)
135KB
2.5K
SLoC
Rust Landlock library
Landlock is a security feature available since Linux 5.13. The goal is to enable to restrict ambient rights (e.g., global filesystem access) for a set of processes by creating safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs, unexpected or malicious behaviors in applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves. More information about Landlock can be found in the official website.
This Rust crate provides a safe abstraction for the Landlock system calls along with some helpers.
Use cases
This crate is especially useful to protect users' data by sandboxing:
- trusted applications dealing with potentially malicious data (e.g., complex file format, network request) that could exploit security vulnerabilities;
- sandbox managers, container runtimes or shells launching untrusted applications.
Examples
A simple example can be found with the
path_beneath_rules()
helper.
More complex examples can be found with the
Ruleset
documentation
and the sandboxer example.
Crate documentation
Changelog
Dependencies
~0.3–0.8MB
~19K SLoC