Zoup

Fair, KPI for software engineering is shit distilled.

V0.1.11 out, with env support and bunch of other fixes, update!

Thanks!

they can be jailed by landlock, we don't have support in go-landlock tho afaik, @Gnoack

well yeah maybe, if you like.

ROX isn't self-contradictory, Allowing read() and execve(), but denying write() and truncate() are totally valid and common in secure execution contexts, although things gets worse with directory traverse.

So yeah, --rox is fine semantically, just ugly. :D

good catch, fixed.

give it a try with v0.10: landrun --rox /usr/ --ro /usr/lib ls /usr/bin/

Thank you all for your support, I really didn't expect this to take off like this! given that project is roughly two days old (:D) it's still fair to expect some issues all around, please report them on GH if you found one.

it's recursive by default

yeah it wasn't the best call, have a look at v0.1.4, I think it's better now!

in this case doesn't have access to "a" wherever it is...

$ landrun --ro /usr cat /usr/bin/ls | wc -l

400

executing ls (as in actual binary execution) will require --exec

$ landrun --ro /usr ls /usr/bin/

ls: cannot open directory '/usr/bin/': Permission denied

$ landrun --ro /usr --exec ls /usr/bin/

list of billions of files

note that I don't really love the --exec thingy, if it's not "on" by default it's just for sake of being explicit.

Update: there's a bug to limit "file access", which I'll fix asap.

Update2: Adding a --exec-path instead to limit executable, it wasn't the best idea to have a global --exec anyway

Update3: Have a look at V0.1.4, I think it's far cleaner now.

running cat isn't a --exec for one :)