dtprobed: adopt Landlock
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- C
- Stars
- 189
- Forks
- 23
- PR merge metrics
- No merged PRs in 30d
Description
dtprobed already uses seccomp, but there's a new Linux sandboxing LSM in town which solves a bunch of problems seccomp has wrt abstraction and targeting the wrong layer.
We should be able to use it to restrict precisely our access to the device node/socket. See https://docs.kernel.org/userspace-api/landlock.html. xz has a nice example of some simple usage.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating dtprobed's existing seccomp setup and read the linked Landlock userspace API documentation, using xz's example as a usage reference. Confirm which device node and socket access dtprobed needs, then verify that Landlock restricts other access without breaking those paths.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100