Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

landlock: restrict tcp sockets #6077

Open
osevan opened this issue Nov 3, 2023 · 1 comment
Open

landlock: restrict tcp sockets #6077

osevan opened this issue Nov 3, 2023 · 1 comment
Labels
enhancement New feature request networking Issues related to networking features (--net=, etc)

Comments

@osevan
Copy link

osevan commented Nov 3, 2023

I hope everyone with eye on landlock functionality could plant this feature as fast as possible inside firejail.

https://www.phoronix.com/news/Landlock-Networking-Linux-6.7

Thanks and

Best regards

@rusty-snake
Copy link
Collaborator

For landlock I would say we should deny to bind to any tcp port and allow to connect to all tcp ports.

For fine grained control options we could use landlock.bind-tcp/landlock.connect-tcp (or namespaced landlock[.net].tcp.bind / landlock[.net].bind) or a implementation free name line whitelist-tcp-bind/whitelist-tcp-connect (systemd uses SocketBindAllow/SocketBindDeny implemented with cgroup/bind[46]).

We should also ask whether exposing those low-level options make sense for firejail. While restricting bind sounds interesting, restricting connect for tcp connections could give a lot users a false-sense of security(/privacy) unless other layer 4 protocols (udp and the like) are blocked by other means (seccomp/cgroup/ebpf/nftables/netfilter).

@rusty-snake rusty-snake added the enhancement New feature request label Nov 3, 2023
@kmk3 kmk3 changed the title landlock stream sockets tcp added inside kernel. landlock: restrict tcp sockets Sep 13, 2024
@kmk3 kmk3 added the networking Issues related to networking features (--net=, etc) label Sep 14, 2024
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
enhancement New feature request networking Issues related to networking features (--net=, etc)
Projects
None yet
Development

No branches or pull requests

3 participants