Landlock for Python

Warnings

• breaking The `landlock` library is a binding for the Linux Landlock Security Module. It will only function on Linux systems running kernel version 5.13 or newer with Landlock support enabled. It is not compatible with other operating systems or older Linux kernels.
  Fix: Ensure your environment is a compatible Linux distribution with a supported kernel version and Landlock enabled. Check `/proc/filesystems` for `landlock` entry or try `landlock.get_abi_version()` (if available in this specific binding) to confirm.
• gotcha Landlock rules are immutable and cannot be removed or relaxed once applied to a thread. Any child processes or threads created after `ruleset.apply()` will inherit the parent's restrictions. Children can only add *further* restrictions, not lessen existing ones.
  Fix: Design your application's security policy carefully. Apply the least permissive rules as late as possible in your program's execution flow, typically before processing untrusted input.
• gotcha This specific `landlock` library (Edward-Knight's) explicitly states that it does not support Landlock ABI version 4 features, such as TCP bind and connect restrictions. Therefore, network sandboxing capabilities are limited or unavailable through this binding.
  Fix: If network access control is critical, you may need to explore alternative Landlock Python bindings (e.g., `py-landlock` from SebastienWae) or other Linux security mechanisms (e.g., cgroups, seccomp-bpf).
• gotcha Landlock has limitations regarding filesystem topology. Sandboxed threads cannot modify the filesystem topology (e.g., via `mount(2)` or `pivot_root(2)`). However, `chroot(2)` is permitted.
  Fix: Be aware of these limitations when designing your sandbox. Do not expect to remount filesystems or change the root directory (except `chroot`) within a Landlock-restricted process.
• gotcha The kernel enforces a limit of 16 stacked Landlock rulesets per thread. Attempting to apply more rulesets than this limit will result in an `E2BIG` error.
  Fix: Consolidate your Landlock rules into as few rulesets as possible. If multiple granular policies are needed, consider designing them hierarchically or applying them at different stages of your application's lifecycle, rather than excessive stacking.

Install

• pip install landlock Install with pip

Imports

• Ruleset

  from landlock import Ruleset

  This is the primary class for defining and applying Landlock rules.

Quickstart

This quickstart demonstrates how to create a Landlock ruleset to restrict filesystem access. It allows reading the current directory and executing `ls` and `cat` from `/usr/bin`, while implicitly denying access to all other paths, such as `/etc/passwd`. The `apply()` method enforces these rules on the current thread and its children.

import os
from landlock import Ruleset, LandlockError

def main():
    # Create a ruleset, by default it disallows all filesystem access
    rs = Ruleset()
    
    # Explicitly allow read access to the current directory and its contents
    # and execute access to /usr/bin for common commands
    rs.allow_read('.')
    rs.allow_execute('/usr/bin/ls')
    rs.allow_execute('/usr/bin/cat')
    
    try:
        # Apply the Landlock ruleset to the current thread
        rs.apply()
        print("Landlock rules applied. Trying to access allowed paths...")
        
        # This should succeed
        print(f"Current directory listing: {os.listdir('.')}")
        os.system("ls -l .")
        
        print("\nTrying to access a disallowed path (/etc/passwd)...")
        # This should fail with a PermissionError (or similar LandlockError)
        try:
            with open('/etc/passwd', 'r') as f:
                _ = f.read()
            print("Accessed /etc/passwd (unexpectedly succeeded)")
        except LandlockError as e:
            print(f"Caught expected LandlockError: {e}")
        except PermissionError as e:
            print(f"Caught expected PermissionError: {e}")
        
    except LandlockError as e:
        print(f"Landlock is not available or failed to apply rules: {e}")
    except Exception as e:
        print(f"An unexpected error occurred: {e}")

if __name__ == '__main__':
    main()