Software Using Landlock
- egress-eddie, a filter for outgoing traffic, by Andrew LeFevre
- Emilua, a Lua execution engine, by Vinícius dos Santos Oliveira
- Landlocked Make, a Landlock-enabled version of GNU Make by Justine Tunney
- minijail (Github) (part of ChromeOS and Android)
setprivutility inutil-linux- sslh
- Suricata: Intrusion detection software
- UkuleleWeb, a wiki software by GüntherNoack
- websrv, a web server for static files in Go, by Niklas Gergs
- Wireproxy, a SOCKS proxy that tunnels over a Wireguard VPN, by pufferfish
- xz, a data compression library and utilities
- Was disabled by the attackers who created the infamous xz backdoor (commit).
This is an incomplete list – needs updating
Landlock libraries
- for C, we currently recommend to use the C headers directly
- for Go by GüntherNoack (official)
- for Haskell by Nicolas Trangez
- for Rust by Mickaël Salaün (official)
- for Perl by Marc Ballarin
- for Python by Edward Knight
If there are any missing, let me know!
When developing or picking a Landlock library, keep the following criteria in mind:
- Compatibility across kernel versions
- Graceful degradation on older kernels (LandlockBestEffortMode)
- Will library updates start breaking your software? (LandlockForwardsCompatibilityProblem)
Higher level libraries
- C
- pledge() for Linux (Github) by Justine Tunney
- unveil() for Linux by Martin Chang
- Rust
- extrasafe library by Harry Stern, built on top of
rust-landlock
- extrasafe library by Harry Stern, built on top of
There are various projects which try to recreate OpenBSD’s pledge() and unveil() syscalls on top of Landlock. This is much easier to build with Landlock than with Seccomp-BPF, but the kernel-level API still does not make it possible to be 100% compatible. Some differences in the semantics are to be expected.