Conversation
@jarkko What is it? Something like https://github.com/multikernel/sandlock ?
1
0
0
@tris for this project and many other i actually just browsed https://elixir.bootlin.com/linux/v7.0.12/source to look for what would fit and then browsed what landlock does and this how things connect.
1
0
1
@jarkko That's a really neat approach. I usually spend some time looking for existing tools solutions before building something myself because I'd rather avoid creating unnecessary tech debt. In this case, your approach makes a lot of sense. Since the kernel is ultimately the source of truth, it's unlikely that an external abstraction or wrapper would provide a better solution. I think it's a pragmatic way to handle a problem like this
1
0
1
Jarkko Sakkinen
jarkko
@tris In the case of blocking agents tackling that outside of paths is the context here. All the bad stuff is always related to paths in security. Landlock does not work in that space so it can brickwall where agen process can move. Thus, it just ended up being the right block.
1
0
0
@tris So if you want to tackle such security problem it's not piling chainsaw, hammer and screwdriver into a hill and put fingers crossed because there's a lot of tools in good use. it's about using right tools right because the adversary in this case is most diffcult to tackle so far.
1
0
0