695 lines · plain
1.. SPDX-License-Identifier: GPL-2.02.. Copyright © 2017-2020 Mickaël Salaün <mic@digikod.net>3.. Copyright © 2019-2020 ANSSI4.. Copyright © 2021-2022 Microsoft Corporation5 6=====================================7Landlock: unprivileged access control8=====================================9 10:Author: Mickaël Salaün11:Date: October 202412 13The goal of Landlock is to enable restriction of ambient rights (e.g. global14filesystem or network access) for a set of processes. Because Landlock15is a stackable LSM, it makes it possible to create safe security sandboxes as16new security layers in addition to the existing system-wide access-controls.17This kind of sandbox is expected to help mitigate the security impact of bugs or18unexpected/malicious behaviors in user space applications. Landlock empowers19any process, including unprivileged ones, to securely restrict themselves.20 21We can quickly make sure that Landlock is enabled in the running system by22looking for "landlock: Up and running" in kernel logs (as root):23``dmesg | grep landlock || journalctl -kb -g landlock`` .24Developers can also easily check for Landlock support with a25:ref:`related system call <landlock_abi_versions>`.26If Landlock is not currently supported, we need to27:ref:`configure the kernel appropriately <kernel_support>`.28 29Landlock rules30==============31 32A Landlock rule describes an action on an object which the process intends to33perform. A set of rules is aggregated in a ruleset, which can then restrict34the thread enforcing it, and its future children.35 36The two existing types of rules are:37 38Filesystem rules39 For these rules, the object is a file hierarchy,40 and the related filesystem actions are defined with41 `filesystem access rights`.42 43Network rules (since ABI v4)44 For these rules, the object is a TCP port,45 and the related actions are defined with `network access rights`.46 47Defining and enforcing a security policy48----------------------------------------49 50We first need to define the ruleset that will contain our rules.51 52For this example, the ruleset will contain rules that only allow filesystem53read actions and establish a specific TCP connection. Filesystem write54actions and other TCP actions will be denied.55 56The ruleset then needs to handle both these kinds of actions. This is57required for backward and forward compatibility (i.e. the kernel and user58space may not know each other's supported restrictions), hence the need59to be explicit about the denied-by-default access rights.60 61.. code-block:: c62 63 struct landlock_ruleset_attr ruleset_attr = {64 .handled_access_fs =65 LANDLOCK_ACCESS_FS_EXECUTE |66 LANDLOCK_ACCESS_FS_WRITE_FILE |67 LANDLOCK_ACCESS_FS_READ_FILE |68 LANDLOCK_ACCESS_FS_READ_DIR |69 LANDLOCK_ACCESS_FS_REMOVE_DIR |70 LANDLOCK_ACCESS_FS_REMOVE_FILE |71 LANDLOCK_ACCESS_FS_MAKE_CHAR |72 LANDLOCK_ACCESS_FS_MAKE_DIR |73 LANDLOCK_ACCESS_FS_MAKE_REG |74 LANDLOCK_ACCESS_FS_MAKE_SOCK |75 LANDLOCK_ACCESS_FS_MAKE_FIFO |76 LANDLOCK_ACCESS_FS_MAKE_BLOCK |77 LANDLOCK_ACCESS_FS_MAKE_SYM |78 LANDLOCK_ACCESS_FS_REFER |79 LANDLOCK_ACCESS_FS_TRUNCATE |80 LANDLOCK_ACCESS_FS_IOCTL_DEV,81 .handled_access_net =82 LANDLOCK_ACCESS_NET_BIND_TCP |83 LANDLOCK_ACCESS_NET_CONNECT_TCP,84 .scoped =85 LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |86 LANDLOCK_SCOPE_SIGNAL,87 };88 89Because we may not know which kernel version an application will be executed90on, it is safer to follow a best-effort security approach. Indeed, we91should try to protect users as much as possible whatever the kernel they are92using.93 94To be compatible with older Linux versions, we detect the available Landlock ABI95version, and only use the available subset of access rights:96 97.. code-block:: c98 99 int abi;100 101 abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);102 if (abi < 0) {103 /* Degrades gracefully if Landlock is not handled. */104 perror("The running kernel does not enable to use Landlock");105 return 0;106 }107 switch (abi) {108 case 1:109 /* Removes LANDLOCK_ACCESS_FS_REFER for ABI < 2 */110 ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_REFER;111 __attribute__((fallthrough));112 case 2:113 /* Removes LANDLOCK_ACCESS_FS_TRUNCATE for ABI < 3 */114 ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_TRUNCATE;115 __attribute__((fallthrough));116 case 3:117 /* Removes network support for ABI < 4 */118 ruleset_attr.handled_access_net &=119 ~(LANDLOCK_ACCESS_NET_BIND_TCP |120 LANDLOCK_ACCESS_NET_CONNECT_TCP);121 __attribute__((fallthrough));122 case 4:123 /* Removes LANDLOCK_ACCESS_FS_IOCTL_DEV for ABI < 5 */124 ruleset_attr.handled_access_fs &= ~LANDLOCK_ACCESS_FS_IOCTL_DEV;125 __attribute__((fallthrough));126 case 5:127 /* Removes LANDLOCK_SCOPE_* for ABI < 6 */128 ruleset_attr.scoped &= ~(LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET |129 LANDLOCK_SCOPE_SIGNAL);130 }131 132This enables the creation of an inclusive ruleset that will contain our rules.133 134.. code-block:: c135 136 int ruleset_fd;137 138 ruleset_fd = landlock_create_ruleset(&ruleset_attr, sizeof(ruleset_attr), 0);139 if (ruleset_fd < 0) {140 perror("Failed to create a ruleset");141 return 1;142 }143 144We can now add a new rule to this ruleset thanks to the returned file145descriptor referring to this ruleset. The rule will only allow reading the146file hierarchy ``/usr``. Without another rule, write actions would then be147denied by the ruleset. To add ``/usr`` to the ruleset, we open it with the148``O_PATH`` flag and fill the &struct landlock_path_beneath_attr with this file149descriptor.150 151.. code-block:: c152 153 int err;154 struct landlock_path_beneath_attr path_beneath = {155 .allowed_access =156 LANDLOCK_ACCESS_FS_EXECUTE |157 LANDLOCK_ACCESS_FS_READ_FILE |158 LANDLOCK_ACCESS_FS_READ_DIR,159 };160 161 path_beneath.parent_fd = open("/usr", O_PATH | O_CLOEXEC);162 if (path_beneath.parent_fd < 0) {163 perror("Failed to open file");164 close(ruleset_fd);165 return 1;166 }167 err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_PATH_BENEATH,168 &path_beneath, 0);169 close(path_beneath.parent_fd);170 if (err) {171 perror("Failed to update ruleset");172 close(ruleset_fd);173 return 1;174 }175 176It may also be required to create rules following the same logic as explained177for the ruleset creation, by filtering access rights according to the Landlock178ABI version. In this example, this is not required because all of the requested179``allowed_access`` rights are already available in ABI 1.180 181For network access-control, we can add a set of rules that allow to use a port182number for a specific action: HTTPS connections.183 184.. code-block:: c185 186 struct landlock_net_port_attr net_port = {187 .allowed_access = LANDLOCK_ACCESS_NET_CONNECT_TCP,188 .port = 443,189 };190 191 err = landlock_add_rule(ruleset_fd, LANDLOCK_RULE_NET_PORT,192 &net_port, 0);193 194The next step is to restrict the current thread from gaining more privileges195(e.g. through a SUID binary). We now have a ruleset with the first rule196allowing read access to ``/usr`` while denying all other handled accesses for197the filesystem, and a second rule allowing HTTPS connections.198 199.. code-block:: c200 201 if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) {202 perror("Failed to restrict privileges");203 close(ruleset_fd);204 return 1;205 }206 207The current thread is now ready to sandbox itself with the ruleset.208 209.. code-block:: c210 211 if (landlock_restrict_self(ruleset_fd, 0)) {212 perror("Failed to enforce ruleset");213 close(ruleset_fd);214 return 1;215 }216 close(ruleset_fd);217 218If the ``landlock_restrict_self`` system call succeeds, the current thread is219now restricted and this policy will be enforced on all its subsequently created220children as well. Once a thread is landlocked, there is no way to remove its221security policy; only adding more restrictions is allowed. These threads are222now in a new Landlock domain, which is a merger of their parent one (if any)223with the new ruleset.224 225Full working code can be found in `samples/landlock/sandboxer.c`_.226 227Good practices228--------------229 230It is recommended to set access rights to file hierarchy leaves as much as231possible. For instance, it is better to be able to have ``~/doc/`` as a232read-only hierarchy and ``~/tmp/`` as a read-write hierarchy, compared to233``~/`` as a read-only hierarchy and ``~/tmp/`` as a read-write hierarchy.234Following this good practice leads to self-sufficient hierarchies that do not235depend on their location (i.e. parent directories). This is particularly236relevant when we want to allow linking or renaming. Indeed, having consistent237access rights per directory enables changing the location of such directories238without relying on the destination directory access rights (except those that239are required for this operation, see ``LANDLOCK_ACCESS_FS_REFER``240documentation).241 242Having self-sufficient hierarchies also helps to tighten the required access243rights to the minimal set of data. This also helps avoid sinkhole directories,244i.e. directories where data can be linked to but not linked from. However,245this depends on data organization, which might not be controlled by developers.246In this case, granting read-write access to ``~/tmp/``, instead of write-only247access, would potentially allow moving ``~/tmp/`` to a non-readable directory248and still keep the ability to list the content of ``~/tmp/``.249 250Layers of file path access rights251---------------------------------252 253Each time a thread enforces a ruleset on itself, it updates its Landlock domain254with a new layer of policy. This complementary policy is stacked with any255other rulesets potentially already restricting this thread. A sandboxed thread256can then safely add more constraints to itself with a new enforced ruleset.257 258One policy layer grants access to a file path if at least one of its rules259encountered on the path grants the access. A sandboxed thread can only access260a file path if all its enforced policy layers grant the access as well as all261the other system access controls (e.g. filesystem DAC, other LSM policies,262etc.).263 264Bind mounts and OverlayFS265-------------------------266 267Landlock enables restricting access to file hierarchies, which means that these268access rights can be propagated with bind mounts (cf.269Documentation/filesystems/sharedsubtree.rst) but not with270Documentation/filesystems/overlayfs.rst.271 272A bind mount mirrors a source file hierarchy to a destination. The destination273hierarchy is then composed of the exact same files, on which Landlock rules can274be tied, either via the source or the destination path. These rules restrict275access when they are encountered on a path, which means that they can restrict276access to multiple file hierarchies at the same time, whether these hierarchies277are the result of bind mounts or not.278 279An OverlayFS mount point consists of upper and lower layers. These layers are280combined in a merge directory, and that merged directory becomes available at281the mount point. This merge hierarchy may include files from the upper and282lower layers, but modifications performed on the merge hierarchy only reflect283on the upper layer. From a Landlock policy point of view, all OverlayFS layers284and merge hierarchies are standalone and each contains their own set of files285and directories, which is different from bind mounts. A policy restricting an286OverlayFS layer will not restrict the resulted merged hierarchy, and vice versa.287Landlock users should then only think about file hierarchies they want to allow288access to, regardless of the underlying filesystem.289 290Inheritance291-----------292 293Every new thread resulting from a :manpage:`clone(2)` inherits Landlock domain294restrictions from its parent. This is similar to seccomp inheritance (cf.295Documentation/userspace-api/seccomp_filter.rst) or any other LSM dealing with296task's :manpage:`credentials(7)`. For instance, one process's thread may apply297Landlock rules to itself, but they will not be automatically applied to other298sibling threads (unlike POSIX thread credential changes, cf.299:manpage:`nptl(7)`).300 301When a thread sandboxes itself, we have the guarantee that the related security302policy will stay enforced on all this thread's descendants. This allows303creating standalone and modular security policies per application, which will304automatically be composed between themselves according to their runtime parent305policies.306 307Ptrace restrictions308-------------------309 310A sandboxed process has less privileges than a non-sandboxed process and must311then be subject to additional restrictions when manipulating another process.312To be allowed to use :manpage:`ptrace(2)` and related syscalls on a target313process, a sandboxed process should have a superset of the target process's314access rights, which means the tracee must be in a sub-domain of the tracer.315 316IPC scoping317-----------318 319Similar to the implicit `Ptrace restrictions`_, we may want to further restrict320interactions between sandboxes. Each Landlock domain can be explicitly scoped321for a set of actions by specifying it on a ruleset. For example, if a322sandboxed process should not be able to :manpage:`connect(2)` to a323non-sandboxed process through abstract :manpage:`unix(7)` sockets, we can324specify such a restriction with ``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET``.325Moreover, if a sandboxed process should not be able to send a signal to a326non-sandboxed process, we can specify this restriction with327``LANDLOCK_SCOPE_SIGNAL``.328 329A sandboxed process can connect to a non-sandboxed process when its domain is330not scoped. If a process's domain is scoped, it can only connect to sockets331created by processes in the same scope.332Moreover, If a process is scoped to send signal to a non-scoped process, it can333only send signals to processes in the same scope.334 335A connected datagram socket behaves like a stream socket when its domain is336scoped, meaning if the domain is scoped after the socket is connected , it can337still :manpage:`send(2)` data just like a stream socket. However, in the same338scenario, a non-connected datagram socket cannot send data (with339:manpage:`sendto(2)`) outside its scope.340 341A process with a scoped domain can inherit a socket created by a non-scoped342process. The process cannot connect to this socket since it has a scoped343domain.344 345IPC scoping does not support exceptions, so if a domain is scoped, no rules can346be added to allow access to resources or processes outside of the scope.347 348Truncating files349----------------350 351The operations covered by ``LANDLOCK_ACCESS_FS_WRITE_FILE`` and352``LANDLOCK_ACCESS_FS_TRUNCATE`` both change the contents of a file and sometimes353overlap in non-intuitive ways. It is recommended to always specify both of354these together.355 356A particularly surprising example is :manpage:`creat(2)`. The name suggests357that this system call requires the rights to create and write files. However,358it also requires the truncate right if an existing file under the same name is359already present.360 361It should also be noted that truncating files does not require the362``LANDLOCK_ACCESS_FS_WRITE_FILE`` right. Apart from the :manpage:`truncate(2)`363system call, this can also be done through :manpage:`open(2)` with the flags364``O_RDONLY | O_TRUNC``.365 366The truncate right is associated with the opened file (see below).367 368Rights associated with file descriptors369---------------------------------------370 371When opening a file, the availability of the ``LANDLOCK_ACCESS_FS_TRUNCATE`` and372``LANDLOCK_ACCESS_FS_IOCTL_DEV`` rights is associated with the newly created373file descriptor and will be used for subsequent truncation and ioctl attempts374using :manpage:`ftruncate(2)` and :manpage:`ioctl(2)`. The behavior is similar375to opening a file for reading or writing, where permissions are checked during376:manpage:`open(2)`, but not during the subsequent :manpage:`read(2)` and377:manpage:`write(2)` calls.378 379As a consequence, it is possible that a process has multiple open file380descriptors referring to the same file, but Landlock enforces different things381when operating with these file descriptors. This can happen when a Landlock382ruleset gets enforced and the process keeps file descriptors which were opened383both before and after the enforcement. It is also possible to pass such file384descriptors between processes, keeping their Landlock properties, even when some385of the involved processes do not have an enforced Landlock ruleset.386 387Compatibility388=============389 390Backward and forward compatibility391----------------------------------392 393Landlock is designed to be compatible with past and future versions of the394kernel. This is achieved thanks to the system call attributes and the395associated bitflags, particularly the ruleset's ``handled_access_fs``. Making396handled access rights explicit enables the kernel and user space to have a clear397contract with each other. This is required to make sure sandboxing will not398get stricter with a system update, which could break applications.399 400Developers can subscribe to the `Landlock mailing list401<https://subspace.kernel.org/lists.linux.dev.html>`_ to knowingly update and402test their applications with the latest available features. In the interest of403users, and because they may use different kernel versions, it is strongly404encouraged to follow a best-effort security approach by checking the Landlock405ABI version at runtime and only enforcing the supported features.406 407.. _landlock_abi_versions:408 409Landlock ABI versions410---------------------411 412The Landlock ABI version can be read with the sys_landlock_create_ruleset()413system call:414 415.. code-block:: c416 417 int abi;418 419 abi = landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION);420 if (abi < 0) {421 switch (errno) {422 case ENOSYS:423 printf("Landlock is not supported by the current kernel.\n");424 break;425 case EOPNOTSUPP:426 printf("Landlock is currently disabled.\n");427 break;428 }429 return 0;430 }431 if (abi >= 2) {432 printf("Landlock supports LANDLOCK_ACCESS_FS_REFER.\n");433 }434 435The following kernel interfaces are implicitly supported by the first ABI436version. Features only supported from a specific version are explicitly marked437as such.438 439Kernel interface440================441 442Access rights443-------------444 445.. kernel-doc:: include/uapi/linux/landlock.h446 :identifiers: fs_access net_access scope447 448Creating a new ruleset449----------------------450 451.. kernel-doc:: security/landlock/syscalls.c452 :identifiers: sys_landlock_create_ruleset453 454.. kernel-doc:: include/uapi/linux/landlock.h455 :identifiers: landlock_ruleset_attr456 457Extending a ruleset458-------------------459 460.. kernel-doc:: security/landlock/syscalls.c461 :identifiers: sys_landlock_add_rule462 463.. kernel-doc:: include/uapi/linux/landlock.h464 :identifiers: landlock_rule_type landlock_path_beneath_attr465 landlock_net_port_attr466 467Enforcing a ruleset468-------------------469 470.. kernel-doc:: security/landlock/syscalls.c471 :identifiers: sys_landlock_restrict_self472 473Current limitations474===================475 476Filesystem topology modification477--------------------------------478 479Threads sandboxed with filesystem restrictions cannot modify filesystem480topology, whether via :manpage:`mount(2)` or :manpage:`pivot_root(2)`.481However, :manpage:`chroot(2)` calls are not denied.482 483Special filesystems484-------------------485 486Access to regular files and directories can be restricted by Landlock,487according to the handled accesses of a ruleset. However, files that do not488come from a user-visible filesystem (e.g. pipe, socket), but can still be489accessed through ``/proc/<pid>/fd/*``, cannot currently be explicitly490restricted. Likewise, some special kernel filesystems such as nsfs, which can491be accessed through ``/proc/<pid>/ns/*``, cannot currently be explicitly492restricted. However, thanks to the `ptrace restrictions`_, access to such493sensitive ``/proc`` files are automatically restricted according to domain494hierarchies. Future Landlock evolutions could still enable to explicitly495restrict such paths with dedicated ruleset flags.496 497Ruleset layers498--------------499 500There is a limit of 16 layers of stacked rulesets. This can be an issue for a501task willing to enforce a new ruleset in complement to its 16 inherited502rulesets. Once this limit is reached, sys_landlock_restrict_self() returns503E2BIG. It is then strongly suggested to carefully build rulesets once in the504life of a thread, especially for applications able to launch other applications505that may also want to sandbox themselves (e.g. shells, container managers,506etc.).507 508Memory usage509------------510 511Kernel memory allocated to create rulesets is accounted and can be restricted512by the Documentation/admin-guide/cgroup-v1/memory.rst.513 514IOCTL support515-------------516 517The ``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right restricts the use of518:manpage:`ioctl(2)`, but it only applies to *newly opened* device files. This519means specifically that pre-existing file descriptors like stdin, stdout and520stderr are unaffected.521 522Users should be aware that TTY devices have traditionally permitted to control523other processes on the same TTY through the ``TIOCSTI`` and ``TIOCLINUX`` IOCTL524commands. Both of these require ``CAP_SYS_ADMIN`` on modern Linux systems, but525the behavior is configurable for ``TIOCSTI``.526 527On older systems, it is therefore recommended to close inherited TTY file528descriptors, or to reopen them from ``/proc/self/fd/*`` without the529``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right, if possible.530 531Landlock's IOCTL support is coarse-grained at the moment, but may become more532fine-grained in the future. Until then, users are advised to establish the533guarantees that they need through the file hierarchy, by only allowing the534``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right on files where it is really required.535 536Previous limitations537====================538 539File renaming and linking (ABI < 2)540-----------------------------------541 542Because Landlock targets unprivileged access controls, it needs to properly543handle composition of rules. Such property also implies rules nesting.544Properly handling multiple layers of rulesets, each one of them able to545restrict access to files, also implies inheritance of the ruleset restrictions546from a parent to its hierarchy. Because files are identified and restricted by547their hierarchy, moving or linking a file from one directory to another implies548propagation of the hierarchy constraints, or restriction of these actions549according to the potentially lost constraints. To protect against privilege550escalations through renaming or linking, and for the sake of simplicity,551Landlock previously limited linking and renaming to the same directory.552Starting with the Landlock ABI version 2, it is now possible to securely553control renaming and linking thanks to the new ``LANDLOCK_ACCESS_FS_REFER``554access right.555 556File truncation (ABI < 3)557-------------------------558 559File truncation could not be denied before the third Landlock ABI, so it is560always allowed when using a kernel that only supports the first or second ABI.561 562Starting with the Landlock ABI version 3, it is now possible to securely control563truncation thanks to the new ``LANDLOCK_ACCESS_FS_TRUNCATE`` access right.564 565TCP bind and connect (ABI < 4)566------------------------------567 568Starting with the Landlock ABI version 4, it is now possible to restrict TCP569bind and connect actions to only a set of allowed ports thanks to the new570``LANDLOCK_ACCESS_NET_BIND_TCP`` and ``LANDLOCK_ACCESS_NET_CONNECT_TCP``571access rights.572 573Device IOCTL (ABI < 5)574----------------------575 576IOCTL operations could not be denied before the fifth Landlock ABI, so577:manpage:`ioctl(2)` is always allowed when using a kernel that only supports an578earlier ABI.579 580Starting with the Landlock ABI version 5, it is possible to restrict the use of581:manpage:`ioctl(2)` on character and block devices using the new582``LANDLOCK_ACCESS_FS_IOCTL_DEV`` right.583 584Abstract UNIX socket (ABI < 6)585------------------------------586 587Starting with the Landlock ABI version 6, it is possible to restrict588connections to an abstract :manpage:`unix(7)` socket by setting589``LANDLOCK_SCOPE_ABSTRACT_UNIX_SOCKET`` to the ``scoped`` ruleset attribute.590 591Signal (ABI < 6)592----------------593 594Starting with the Landlock ABI version 6, it is possible to restrict595:manpage:`signal(7)` sending by setting ``LANDLOCK_SCOPE_SIGNAL`` to the596``scoped`` ruleset attribute.597 598.. _kernel_support:599 600Kernel support601==============602 603Build time configuration604------------------------605 606Landlock was first introduced in Linux 5.13 but it must be configured at build607time with ``CONFIG_SECURITY_LANDLOCK=y``. Landlock must also be enabled at boot608time like other security modules. The list of security modules enabled by609default is set with ``CONFIG_LSM``. The kernel configuration should then610contain ``CONFIG_LSM=landlock,[...]`` with ``[...]`` as the list of other611potentially useful security modules for the running system (see the612``CONFIG_LSM`` help).613 614Boot time configuration615-----------------------616 617If the running kernel does not have ``landlock`` in ``CONFIG_LSM``, then we can618enable Landlock by adding ``lsm=landlock,[...]`` to619Documentation/admin-guide/kernel-parameters.rst in the boot loader620configuration.621 622For example, if the current built-in configuration is:623 624.. code-block:: console625 626 $ zgrep -h "^CONFIG_LSM=" "/boot/config-$(uname -r)" /proc/config.gz 2>/dev/null627 CONFIG_LSM="lockdown,yama,integrity,apparmor"628 629...and if the cmdline doesn't contain ``landlock`` either:630 631.. code-block:: console632 633 $ sed -n 's/.*\(\<lsm=\S\+\).*/\1/p' /proc/cmdline634 lsm=lockdown,yama,integrity,apparmor635 636...we should configure the boot loader to set a cmdline extending the ``lsm``637list with the ``landlock,`` prefix::638 639 lsm=landlock,lockdown,yama,integrity,apparmor640 641After a reboot, we can check that Landlock is up and running by looking at642kernel logs:643 644.. code-block:: console645 646 # dmesg | grep landlock || journalctl -kb -g landlock647 [ 0.000000] Command line: [...] lsm=landlock,lockdown,yama,integrity,apparmor648 [ 0.000000] Kernel command line: [...] lsm=landlock,lockdown,yama,integrity,apparmor649 [ 0.000000] LSM: initializing lsm=lockdown,capability,landlock,yama,integrity,apparmor650 [ 0.000000] landlock: Up and running.651 652The kernel may be configured at build time to always load the ``lockdown`` and653``capability`` LSMs. In that case, these LSMs will appear at the beginning of654the ``LSM: initializing`` log line as well, even if they are not configured in655the boot loader.656 657Network support658---------------659 660To be able to explicitly allow TCP operations (e.g., adding a network rule with661``LANDLOCK_ACCESS_NET_BIND_TCP``), the kernel must support TCP662(``CONFIG_INET=y``). Otherwise, sys_landlock_add_rule() returns an663``EAFNOSUPPORT`` error, which can safely be ignored because this kind of TCP664operation is already not possible.665 666Questions and answers667=====================668 669What about user space sandbox managers?670---------------------------------------671 672Using user space processes to enforce restrictions on kernel resources can lead673to race conditions or inconsistent evaluations (i.e. `Incorrect mirroring of674the OS code and state675<https://www.ndss-symposium.org/ndss2003/traps-and-pitfalls-practical-problems-system-call-interposition-based-security-tools/>`_).676 677What about namespaces and containers?678-------------------------------------679 680Namespaces can help create sandboxes but they are not designed for681access-control and then miss useful features for such use case (e.g. no682fine-grained restrictions). Moreover, their complexity can lead to security683issues, especially when untrusted processes can manipulate them (cf.684`Controlling access to user namespaces <https://lwn.net/Articles/673597/>`_).685 686Additional documentation687========================688 689* Documentation/security/landlock.rst690* https://landlock.io691 692.. Links693.. _samples/landlock/sandboxer.c:694 https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git/tree/samples/landlock/sandboxer.c695