Use landlock for AppImage sandboxing

[TheAssassin]

I've been reading about different Linux sandboxing mechanisms in the past few weeks as such technologies have become even more important due to the rise of agentic coding.

There are many mechanisms, e.g., AppArmor, seccomp, selinux, (unprivileged) namespaces and the less known landlock.

I found about landlock due to nono and found the concept interesting. It's easier to use and implement apparently than container technology (it's meant for end-user stuff, and unprivileged namespaces have been a security nightmare and therefore been restricted or disabled again in most distros), it is a kernel technology (i.e., it works on any distro with a kernel >= 5.13 AFAICS), there is a neat little Rust library that implements the interface, ...

I've had to ask myself, why have I never come across landlock in the AppImage context? Are there reasons for this? Looks like Firejail has added it in a recent releasehttps://github.com/netblue30/firejail/releases/tag/0.9.74

My old criticism of blindly using a tool like Firejail still stands: you need custom application profiles and these profiles must not be distributed just within the (untrusted) AppImage but be available from a trusted source (no, a "web of trust" falls short easily, please don't warm up this discussion). What would work IMO is that an app would "ask" for permissions you could grant upon request, that's how things work on macOS to some extent. What would also work is an easy-to-configure first run wizard (e.g., what AppImageLauncher does) to configure the basics, with an easy-to-use control panel. But this is off-topic. This discussion is about landlock as a technology.

See also the Integrations page. Pretty much all major distros enable it by default, Gentoo being the only exception.

[probonopd]

feature: add Landlock support (netblue30/firejail#5269 netblue30/firejail#6078 netblue30/firejail#6115 netblue30/firejail#6125 netblue30/firejail#6187 netblue30/firejail#6195 netblue30/firejail#6200
netblue30/firejail#6228 netblue30/firejail#6260 netblue30/firejail#6302 netblue30/firejail#6305)

Does this mean we'll get it "for free" and don't need to do anything on our end?

[TheAssassin]

I have no idea what you mean.

[probonopd]

I mean that if Firejail incorporates landlock, we don't need to do anyhting else but use Firejail?

[TheAssassin]

I thought I was clear about this. "Just use Firejail" is not a solution. And I'm not even proposing building a tool ourselves. I think it was @sameru-sama who recently mentioned it, technically distros should implement this. But I am considering writing a proof-of-concept to demonstrate the UX.

Edit: this POC might use FireJail in the background, arguably. But there is more to it.