{"id":122970,"date":"2025-03-25T10:22:49","date_gmt":"2025-03-25T08:22:49","guid":{"rendered":"https:\/\/prohoster.info\/blog\/novosti-interneta\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij"},"modified":"2025-03-25T10:22:49","modified_gmt":"2025-03-25T08:22:49","slug":"proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","status":"publish","type":"post","link":"https:\/\/prohoster.info\/en\/blog\/news\/proekt-landrun-razvivaet-neprivilegirovannuyu-sistemu-izolyaczii-prilozhenij","title":{"rendered":"The Landrun project develops a non-privileged application isolation system.","gt_translate_keys":[{"key":"rendered","format":"text"}]},"content":{"rendered":"
The Landrun project has begun development of a new system for isolated execution of individual applications. For isolation, the LSM module of the Linux kernel Landlock is used, which allows avoiding privileged operations during the creation of a sandbox environment. In terms of its tasks, Landrun is similar to the Firejail utility, but differs in its simpler implementation, lightweight nature, and the ability to run under a regular non-privileged user without being supplied with the suid flag. The project code is written in Go and is distributed under the GPLv2 license. <\/p>\n
The Landlock mechanism allows unprivileged programs to restrict the use of Linux kernel objects, such as file hierarchies, network sockets, and ioctl. Unlike namespaces and system call filtering, the isolated environment is formed by the Linux kernel as an additional layer over existing access control mechanisms. To interact with the Landlock subsystem, the landrun utility uses the go-landlock library developed by the LandLock team. <\/p>\n
Landrun helps reduce the risk of compromising the main system when running untrusted or potentially vulnerable programs. Notable features include support for selective access restrictions at the level of individual directories, binding privileges to file paths (allowing or denying reading, writing, and execution), and control over the initiation and reception of TCP connections. <\/p>\n
For example, with Landrun, the process can be restricted from launching executable files, allowing write access only to a specific subdirectory with data, prohibiting the creation of listening sockets for accepting network connections, and allowing sending network requests only to specified TCP ports. In the simplest case, to deny writing, execution, and network capabilities, the program can be executed with the command \"landrun -ro \/\", and for isolating nginx, you can use: landrun -rox \/usr\/bin -ro \/lib,\/lib64,\/var\/www -rwx \/var\/log -bind-tcp 80,443 \/usr\/bin\/nginx <\/p>\n
Future plans mention enhanced file system access control, support for UDP, and process resource management. To restrict access at the file system level, at least Linux kernel 5.13 is required, and for network restrictions - 6.8. <\/p>\n