Re: current landlock limitations and what it means for sandboxer

On 8/31/22 6:31 AM, Mickaël Salaün wrote:
>
> On 31/08/2022 02:22, Jeff Xu wrote:
>> Hello, Mickaël
>
> Hello Jeff,
>
> Thanks for these interesting questions.
>
>>
>> I would like to dig into the limitation of landlock, to understand
>> more about the design approach of using landlock for sandboxing user
>> space applications.


This has spurred a long standing curiosity with meon landlock.  Can 
landlock quarrantine a bad-acting binary discovered during machine 
operation?  The way I've understood landlock is it can be used to 
restrict a set of unprivileged processes to sandboxes known on say, 
machine boot up.   But what if during normal operation an anti-malware 
program flags a suspect binary running on a system, but it isn't 100% 
sure that binary is malicious?  Could landlock "lock away" and sandbox 
the suspect-binary for analysis by an admin to determine that suspect 
binary is in fact malicious and should be deleted from the system?  And 
if the suspect binary is determined to be harmless can it be 
unsandboxed/put-back?


Thanks,

Jay