Re: current landlock limitations and what it means for sandboxer

On 31/08/2022 17:48, Jay Freyensee wrote:
> 
> On 8/31/22 6:31 AM, Mickaël Salaün wrote:
>>
>> On 31/08/2022 02:22, Jeff Xu wrote:
>>> Hello, Mickaël
>>
>> Hello Jeff,
>>
>> Thanks for these interesting questions.
>>
>>>
>>> I would like to dig into the limitation of landlock, to understand
>>> more about the design approach of using landlock for sandboxing user
>>> space applications.
> 
> 
> This has spurred a long standing curiosity with meon landlock.  Can
> landlock quarrantine a bad-acting binary discovered during machine
> operation?  The way I've understood landlock is it can be used to
> restrict a set of unprivileged processes to sandboxes known on say,
> machine boot up.   But what if during normal operation an anti-malware
> program flags a suspect binary running on a system, but it isn't 100%
> sure that binary is malicious?  Could landlock "lock away" and sandbox
> the suspect-binary for analysis by an admin to determine that suspect
> binary is in fact malicious and should be deleted from the system?  And
> if the suspect binary is determined to be harmless can it be
> unsandboxed/put-back?

For now, a process can only sandbox itself, the same way seccomp works. 
Such process is then stuck in the sandbox for its whole lifetime.

I think, being able to dynamically move a process in or out of a 
(dedicated) sandbox could be implemented leveraging cgroups, but there 
is some challenge to make it efficient.

fanotify(7) might be interesting for this anti-malware case though.