Follow @Openwall on Twitter for new release announcements and other news
[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Date: Thu, 25 Aug 2016 04:05:49 -0700
From: Andy Lutomirski <>
To: Mickaël Salaün <>
Cc: "" <>, Alexei Starovoitov <>, 
	Arnd Bergmann <>, Casey Schaufler <>, 
	Daniel Borkmann <>, Daniel Mack <>, 
	David Drysdale <>, "David S . Miller" <>, 
	Elena Reshetova <>, James Morris <>, 
	Kees Cook <>, Paul Moore <>, 
	Sargun Dhillon <>, "Serge E . Hallyn" <>, Will Drewry <>, 
	"" <>, Linux API <>, 
	LSM List <>, 
	Network Development <>
Subject: Re: [RFC v2 00/10] Landlock LSM: Unprivileged sandboxing

On Thu, Aug 25, 2016 at 3:32 AM, Mickaël Salaün <> wrote:
> Hi,
> This series is a proof of concept to fill some missing part of seccomp as the
> ability to check syscall argument pointers or creating more dynamic security
> policies. The goal of this new stackable Linux Security Module (LSM) called
> Landlock is to allow any process, including unprivileged ones, to create
> powerful security sandboxes comparable to the Seatbelt/XNU Sandbox or the
> OpenBSD Pledge. This kind of sandbox help to mitigate the security impact of
> bugs or unexpected/malicious behaviors in userland applications.

Maybe I'm missing an obvious description, but: do you have a
description of the eBPF API to landlock?  What function do you
provide, when is it called, what functions can it call, what does the
fancy new arraymap do, etc?


Powered by blists - more mailing lists

Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.