Skip to content

v0.1.17 - Landlock ABI v9 support

Latest
Latest

Choose a tag to compare

View all tags
@Zouuup Zouuup released this 22 Jul 16:29
v0.1.17
62823c0
This commit was signed with the committer’s verified signature.
Zouuup Armin ranjbar
GPG key ID: 8BAF76C560965CAD
Verified
Learn about vigilant mode.

v0.1.17 — Landlock ABI v9 support

landrun now targets Landlock ABI v9 (via go-landlock v0.9.0), adding
IPC scoping, UNIX-socket connect controls, and audit-logging
configuration on top of the existing filesystem and TCP restrictions.

⚠️ Breaking changes

  • The default target is now Landlock ABI v9 in strict mode. On
    kernels that don't support v9, commands now fail unless you pass
    --best-effort (which gracefully degrades to the best ABI your kernel
    supports). Most users on current kernels will want --best-effort.
  • Building from source now requires Go 1.24+.
  • New default restriction — IPC scoping: sandboxed processes can no
    longer connect to abstract UNIX sockets or signal processes outside
    their Landlock domain (ABI v6+). Relax with --unrestricted-scoped if
    this breaks your workload (e.g. some X11 / D-Bus setups).
  • New default restriction — pathname UNIX sockets: on ABI v9+
    kernels, connecting to UNIX sockets created outside the sandbox (DNS
    via nscd, D-Bus, database sockets, etc.) is restricted. Allow specific
    sockets with --unix <path>.

✨ New features

  • --unix <path>: allow connect(2)/sendmsg(2) on a pathname UNIX
    domain socket (ABI v9+).
  • --unrestricted-scoped: opt out of IPC scoping (ABI v6+).
  • --ignore-missing: gracefully ignore paths that don't exist instead
    of erroring.
  • --log-disable-originating, --log-enable-subprocesses,
    --log-disable-subdomains: configure audit logging of Landlock
    denials (ABI v7+).
  • Automatic multithreaded enforcement via thread synchronization
    (TSYNC, ABI v8) when supported by the kernel.

🔧 Internal / maintenance

  • Upgraded go-landlock to v0.9.0 and golang.org/x/sys to v0.40.0.
  • Reworked the restriction engine to enforce all requested domains in a
    single ruleset layer, fixing refer handling in mixed
    restricted/unrestricted configurations.
  • CI: dropped Go 1.22 from the compatibility matrix (now 1.24 + stable).
  • Expanded README (kernel compatibility table V6–V9, Multipath-TCP
    caveat, new examples) and test suite.

📋 Kernel compatibility

Feature Min kernel ABI
IPC scoping (abstract UNIX sockets, signals) 6.12 6
Audit logging of denials 6.15 7
Thread synchronization (TSYNC) 7.0 8
Pathname UNIX socket connect/sendmsg control latest 9

Note: Landlock's TCP restrictions apply only to "classic" TCP sockets.
Since Go 1.24, net.Listen defaults to Multipath TCP and cannot
currently be restricted by Landlock.

Assets 4
Loading