What is Linux Landlock LSM and why is it superior to chroot and seccomp?

Landlock is an unprivileged Linux Security Module (LSM) introduced in Linux 5.13 that allows any application process (without CAP_SYS_ADMIN or root privileges) to restrict its own filesystem and network access rights. Unlike chroot (which requires root and is trivial to escape), Landlock enforces strict path-based hierarchy rules backed by kernel inodes. Unlike seccomp-bpf (which filters raw system calls by number and arguments but cannot safely inspect filesystem path pointers due to TOCTOU race conditions), Landlock evaluates security hooks directly within the VFS inode layer.

What capabilities were added in Landlock ABI v4 and v5?

Landlock ABI v1 introduced core filesystem access rights (reading, writing, executing, creating files/directories). ABI v2 (Linux 5.19) added file truncation control (LANDLOCK_ACCESS_FS_TRUNCATE). ABI v3 (Linux 6.2) added cross-directory link/rename protection (LANDLOCK_ACCESS_FS_REFER). ABI v4 (Linux 6.7) introduced TCP network access controls (LANDLOCK_ACCESS_NET_BIND_TCP and LANDLOCK_ACCESS_NET_CONNECT_TCP), enabling unprivileged network sandboxing. ABI v5 (Linux 6.10) introduced IOCTL command filtering for character and block devices.

Why is prctl(PR_SET_NO_NEW_PRIVS, 1) mandatory before enforcing a Landlock ruleset?

To prevent an unprivileged process from applying a restrictive Landlock ruleset and then executing a SUID (setuid) binary (like /usr/bin/sudo or /usr/bin/passwd) to trick it into operating with unexpected filesystem constraints, the Linux kernel strictly enforces that the calling thread must enable NO_NEW_PRIVS via prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0) or hold CAP_SYS_ADMIN before landlock_restrict_self() can succeed.

How does Landlock ruleset composition and inheritance behave across fork() and execve()?

Landlock rulesets are strictly additive and inherited across fork() and execve(). When a process applies a Landlock ruleset, all future child processes and newly executed binaries automatically inherit the exact same restrictions. If a child process applies a second Landlock ruleset, the kernel computes the intersection (logical AND) of the permissions: the sandbox can only become more restrictive, never more permissive.

Linux Landlock LSM ABI v4 Network & Path Sandboxing Studio

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Linux Kernel 6.7+ LSM Unprivileged Sandboxing ABI v4/v5

Linux Landlock LSM ABI v4 Network & Path Sandboxing Studio

Simulate unprivileged Linux Landlock security policies. Configure VFS inode access bitmasks, TCP bind/connect network scopes, test path traversal restrictions, and generate hardened C / Go production sandboxing boilerplate.

2. Active Path & Port Rules Registry

Configured Allowed Path Rules:

✓ /usr, /lib, /bin → READ_FILE | EXECUTE
✓ /tmp/sandbox_app → READ | WRITE | TRUNCATE
✓ /etc/ssl/certs → READ_FILE

Configured Allowed Network Ports (TCP):

✓ CONNECT → Port 443 (HTTPS outbound)
✓ BIND → Port 8080 (Microservice listener)

3. Probe Target Operation (Sandbox Test)

Operation Type: Target Path or Port:

4. Kernel LSM Decision & Audit Log

POLICY READY FOR TESTING

Configure probe operation and click "Test Kernel Security Decision"

            [kernel] landlock: LSM initialized in unprivileged mode
          

5. Production C Sandboxing Implementation (ABI v4)

Self-contained, unprivileged, zero external dependencies

6. Linux Security Modules & Isolation Mechanisms Compared

Mechanism	Privilege Level Required	VFS Inode Aware?	Network Scoping	TOCTOU Resistance
Linux Landlock LSM	Unprivileged (Any User / Process)	Yes (Internal VFS Hooks)	Yes (ABI v4+ TCP bind/connect)	Immune (Operates on resolved inodes)
seccomp-bpf	Unprivileged (with NO_NEW_PRIVS)	No (Only registers/pointers)	Limited (Syscall opcode only)	Vulnerable to path pointer deref
AppArmor / SELinux	Root / CAP_MAC_ADMIN	Yes	Yes (Full IP / Port / NetFilter)	Immune
chroot(2)	Root / CAP_SYS_CHROOT	Root directory pointer only	None	Trivial to escape without drop caps

Linux Landlock LSM ABI v4 Network & Path Sandboxing Studio

1. Landlock Ruleset Bitmask Definition

2. Active Path & Port Rules Registry

3. Probe Target Operation (Sandbox Test)

4. Kernel LSM Decision & Audit Log

5. Production C Sandboxing Implementation (ABI v4)

6. Linux Security Modules & Isolation Mechanisms Compared

🔍 Companion Workbenches & Verification Tools

Linux CXL Memory Tiering & Page Demotion Studio | Kernel Tiered NUMA Architecture

Linux Block Layer Multi-Queue (blk-mq) & NVMe Studio

Distributed Tracing, OpenTelemetry & W3C TraceContext Studio

Linux Page Tables, TLB Shootdowns & HugePages Architecture Studio

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions