landrun

By default, Landrun targets the highest available Landlock ABI (v9) in strict mode. If your kernel does not support ABI v9, Landrun will fail.

To allow Landrun to run on older kernels by gracefully degrading to the highest supported feature set, use the --best-effort flag.

Degradation Path:

• Linux 7.0+: Full features including TSYNC and ABI v9 UNIX socket controls.
• Linux 6.15+: Adds audit logging (ABI v7).
• Linux 6.12+: Adds IPC scoping (ABI v6).
• Linux 6.7+: Adds network TCP restrictions (ABI v4).
• Linux 6.2-6.6: Filesystem restrictions (including truncation).
• Linux 5.19-6.1: Basic filesystem restrictions (including reparenting).
• Linux 5.13-5.18: Basic filesystem restrictions.
• Older Linux: No restrictions (sandbox disabled).

Landrun relies on Linux kernel features provided by Landlock. Ensure your system meets these requirements:

• General Sandboxing: Linux kernel 5.13 or later with Landlock enabled.
• Network Restrictions (TCP bind/connect): Linux kernel 6.7 or later.
• Building from Source: Go 1.24 or later.

Note on Kernel Versions: By default, Landrun targets Landlock ABI v9. If you are running on an older kernel, you must use the --best-effort flag to allow the sandbox to gracefully degrade to the highest supported ABI.

You can install Landrun using several methods depending on your environment.

Quick Install (Go)

If you have Go installed, use go install:

go install github.com/zouuup/landrun/cmd/landrun@latest

From Source

Clone the repository and build the binary manually:

git clone https://github.com/zouuup/landrun.git
cd landrun
go build -o landrun cmd/landrun/main.go
sudo cp landrun /usr/local/bin/

Package Managers

• Arch Linux: Available via AUR (landrun or landrun-git).
• Slackware: Use sbopkg -i packagename.
• Debian/Ubuntu: Available via apt install landrun (available in Ubuntu 26.04 LTS+ and Debian forky).

You can run services with enhanced security by wrapping the ExecStart command in a systemd service file with Landrun flags.

Example Nginx Configuration:

1. Create /etc/systemd/system/nginx-landrun.service:

[Unit]
Description=nginx with landrun sandbox
After=network.target

[Service]
Type=simple
ExecStart=/usr/bin/landrun \
    --best-effort \
    --rox /usr/bin,/usr/lib \
    --ro  /etc/nginx,/etc/ssl,/etc/passwd,/etc/group,/etc/nsswitch.conf \
    --rwx /var/log/nginx \
    --rwx /var/cache/nginx \
    --bind-tcp 80,443 \
    /usr/bin/nginx -g 'daemon off;'
Restart=always
User=nginx
Group=nginx

[Install]
WantedBy=multi-user.target

2. Enable and start:

sudo systemctl daemon-reload
sudo systemctl enable nginx-landrun
sudo systemctl start nginx-landrun

If you encounter permission errors while running Landrun, follow these steps:

1. Verify Paths: Ensure all required file or directory paths are explicitly granted access using the --ro (read-only) or --rw (read-write) flags.
2. Debug Logging: Run Landrun with --log-level debug to inspect detailed permission information and identify which specific restriction is being triggered.
3. Verify Landlock Support: Check if your kernel has Landlock enabled. Run one of the following commands:

   grep -E 'landlock|lsm=' /boot/config-$(uname -r)
   # OR
   zgrep -iE 'landlock|lsm=' /proc/config.gz
   # OR
   grep -iE 'landlock|lsm=' /lib/modules/$(uname -r)/config
   ```n   You must see `CONFIG_SECURITY_LANDLOCK=y` and `lsm=landlock,...` in the output.

4. Check Kernel Version: For network restrictions, ensure your kernel is 6.7 or later:

   uname -r

The project includes a test suite to verify filesystem controls, network restrictions, and isolation. Use the provided test.sh script to run them.

To preserve the test binary after the run:

./test.sh --keep-binary

To test against the system-installed Landrun binary instead of the local one:

./test.sh --use-system

Landrun uses specific flags to control filesystem access. You can specify paths by repeating the flag or by using comma-separated values (e.g., --ro /usr,/lib).

• --ro <path>: Read-only access.
• --rox <path>: Read-only access with execution permissions.
• --rw <path>: Read-write access.
• --rwx <path>: Read-write access with execution permissions.
• --add-exec: Automatically adds the executing binary to --rox.
• --ldd: Automatically adds required libraries to --rox.
• --ignore-missing: Gracefully ignore paths that do not exist instead of failing.

Important: By default, Landrun applies maximum restrictions (denying all access). You must explicitly add directories or files (like /usr/bin or /lib) to the command you want to run.

landrun --rox /usr/bin/ls --rox /usr/lib --ro /home ls /home

Landrun provides fine-grained control over network and Inter-Process Communication (IPC) using Landlock ABI features.

Network Control

• --bind-tcp <port>: Allow binding to a specific TCP port.
• --connect-tcp <port>: Allow connecting to a specific TCP port.
• --unrestricted-network: Disables all network restrictions.

IPC and Socket Control

• --unix <path>: Allow connect(2)/sendmsg(2) on the specified pathname UNIX domain socket (Requires Landlock ABI v9+).
• --unrestricted-scoped: Allows unrestricted IPC scoping (abstract UNIX sockets and signals). Use this if your workload (like X11 or D-Bus) breaks due to default restrictions (Requires Landlock ABI v6+).
• --unrestricted-scoped [default: disabled].

landrun --rox /usr/ --ro /lib,/lib64 --bind-tcp 8080 --connect-tcp 80 /usr/bin/my-server

Environment Variables

By default, no environment variables are passed to the sandboxed command. Use --env to pass them:

• --env <var>: Pass an environment variable. Format: KEY=VALUE or just KEY to pass the current value from the host.

Logging and Auditing

• --log-level <level>: Set logging level (error, info, debug). [default: error]
• --log-disable-originating: Disable audit logging of denials from the originating process (ABI v7+).
• --log-enable-subprocesses: Enable audit logging of denials after execve(2) in subprocesses (ABI v7+).
• --log-disable-subdomains: Disable audit logging of denials from nested Landlock domains (ABI v7+).

Environment Variable: You can also set the log level via the LANDRUN_LOG_LEVEL environment variable.

landrun --rox /usr --ro /etc --env HOME --env PATH --env CUSTOM_VAR=my_value -- env

Restrict or allow network and IPC access using these flags:

• --unix <path>: Allow connect(2)/sendmsg(2) on this pathname UNIX domain socket (requires Landlock ABI v9+).
• --bind-tcp <port>: Allow binding to specific TCP ports.
• --connect-tcp <port>: Allow connecting to specific TCP ports.
• --unrestricted-network: Allows unrestricted network access.
• --unrestricted-scoped: Allows unrestricted IPC scoping (does not restrict abstract UNIX sockets and signals; requires Landlock ABI v6+).

Manage the environment and logging behavior of the sandboxed process:

• --env <KEY=VALUE|KEY>: Pass environment variables to the command. If only a KEY is provided, the current value from the host environment is used.
• --log-level <level>: Set logging level (error, info, debug). Can be set via LANDRUN_LOG_LEVEL environment variable.
• --best-effort: Use best effort mode (falls back to a less restrictive sandbox if necessary).
• --log-disable-originating: Disable audit logging of denials from the originating process (Landlock ABI v7+).
• --log-enable-subprocesses: Enable audit logging of denials after execve(2) in subprocesses (Landlock ABI v7+).
• --log-disable-subdomains: Disable audit logging of denials from nested Landlock domains (Landlock ABI v7+).