The goal of Landlock is to enable to restrict ambient rights (e.g. global filesystem or network access) for a set of processes. Because Landlock is a stackable LSM, it makes possible to create safe security sandboxes as new security layers in addition to the existing system-wide access-controls. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user space applications. Landlock empowers any process, including unprivileged ones, to securely restrict themselves.

This gist will test whether landlock is enabled on your Linux system.

1. Install the necessary development tools:

apk update apk add build-base linux-headers

2. Compile the Program:

gcc -o landlock_test landlock-test.c

3. Run the Program:

./landlock_test

If everything is set up correctly, the program should output Landlock enabled.

To enable Landlock at boot time, you need to modify the lsm parameter in your boot loader configuration.

To enable Landlock at boot time, you need to modify the lsm parameter in your boot loader configuration. Here’s how you can do it:

1. Open the GRUB configuration file:

nano /etc/default/grub 

2. Add the lsm Parameter:

Find the line starting with GRUB_CMDLINE_LINUX_DEFAULT and modify it to include lsm=landlock,.... It should look something like this:

GRUB_CMDLINE_LINUX_DEFAULT="quiet lsm=landlock,lockdown,yama,integrity,apparmor"

3. Update GRUB:

Update the GRUB configuration:

update-grub

4. Reboot the System:

reboot

After rebooting, verify that Landlock is enabled by checking the kernel logs:

dmesg | grep landlock || journalctl -kb -g landlock

For more details, refer to the Landlock documentation.