Sandbox IDs with Landlock

Landlock is an unprivileged access control designed to create security sandboxes (i.e. Landlock domains). We are working on observability interfaces to identify the cause of denied requests, which require logging (audit) and a dedicated user space interface to get information about Landlock domains.

In this talk, we'll explain the challenges to tie log entries with running processes and their properties, considering the unprivileged approach of Landlock. This led us to create a new kind of ID to tie processes to Landlock domains. We are now working on a new user space interface to safely get information about these Landlock domains. Thanks to its flexibility, Landlock could be leveraged by container runtimes to better isolate processes and now also to cleanly identify them. We'll talk about the container labels/IDs challenges, how Landlock could help, and the potential limitations.