πŸ›‘οΈ Landlock Unprivileged Sandboxing Simulator Linux 5.13+ UAPI

λΉ„νŠΉκΆŒ μœ μ €μŠ€νŽ˜μ΄μŠ€ ν”„λ‘œμ„ΈμŠ€μ˜ 자체 νŒŒμΌμ‹œμŠ€ν…œ μ ‘κ·Ό κΆŒν•œ 격리 및 κ³„μΈ΅ν˜• μƒŒλ“œλ°•μ‹± λ©”μ»€λ‹ˆμ¦˜

Hardened (Landlocked)
⚑ μƒŒλ“œλ°•μŠ€ VFS 검증 νŒŒμ΄ν”„λΌμΈ 및 κΆŒν•œ 트리 ν΄λ¦­ν•˜μ—¬ μ‹œμŠ€ν…œ 콜 경둜 좔적
USERSPACE (Non-Root UID 1000: 'lab') KERNELSPACE (LSM Framework & VFS Layer) Client Task (PID 1042) NO_NEW_PRIVS = 1 Ruleset FD (Syscall 444) PATH_BENEATH (/tmp/sandbox) landlock_restrict_self() Syscall 446 (Permanent) LSM: security_file_open() landlock_file_open() Hierarchy Layer Walk βœ… /tmp/sandbox/ allowed_file.txt (Read/Write) Within Layer Boundary (Granted) πŸ›‘ /tmp/host_secret External Host Token Outside Sandbox (-EACCES)

πŸ“Š μƒŒλ“œλ°•μŠ€ μƒνƒœ μ§€ν‘œ

ν˜„μž¬ 격리 λͺ¨λ“œ: Hardened
Landlock UAPI ABI: v5 (Linux 6.12)
NO_NEW_PRIVS: Locked (1)
μΈκ°€λœ ν•˜μœ„ 디렉터리: /tmp/sandbox/
μ°¨λ‹¨λœ νƒˆμΆœ μ‹œλ„: 0 건

πŸ”’ 핡심 원리 (Self-Restricting)

Landlock은 루트(Root) κΆŒν•œ 없이 ν”„λ‘œμ„ΈμŠ€κ°€ 슀슀둜 μžμ‹ μ˜ 파일/λ„€νŠΈμ›Œν¬ μ ‘κ·Ό λ²”μœ„λ₯Ό μΆ•μ†Œν•˜λŠ” μƒŒλ“œλ°•μŠ€ LSMμž„. κ·œμΉ™μ€ λˆ„μ λ˜μ–΄ 쀑첩(Stacking)되며, ν•œλ²ˆ μ œν•œλœ κΆŒν•œμ€ ν•˜μœ„ ν”„λ‘œμ„ΈμŠ€μ—μ„œλ„ μ ˆλŒ€λ‘œ ν™•μž₯될 수 μ—†μŒ(Fail-Closed).

πŸ“‹ μ‹œμŠ€ν…œ 콜 및 감사 이벀트
[init] Landlock LSM initialized. Active stack: landlock,lockdown,yama,bpf
[setup] Process PID 1042 called prctl(PR_SET_NO_NEW_PRIVS, 1)
[ruleset] Created ruleset FD 3 with PATH_BENEATH -> /tmp/sandbox
[restrict] landlock_restrict_self(FD 3) applied. Sandbox active.