Landlock
kernel-featureopen sourceThe first unprivileged, self-imposed Linux Security Module (): a process sandboxes itself with access rules over real kernel objects.
documentedKernel docs: Landlock ↗
Landlock is an that lets an ordinary, unprivileged process restrict its own access to filesystem paths (and, on newer kernels, TCP ports) with no root and no admin policy. Its hooks fire deep in the kernel after path resolution, so unlike seccomp it decides on the resolved , nouns, not verbs. Restrictions are one-way and inherited by children.
Strengths
- Unprivileged self-sandboxing, no root, no daemon, no policy file
- Semantic, path-aware rules ("writable only under /tmp/work")
- One-way ratchet, inherited by children
Limitations
- Young, filesystem-only in v1; network rules only from ABI v4 / kernel 6.7
- Needs a recent kernel, which hurts portability
- Shared kernel, a kernel LPE is below it