Landlock
An unprivileged sandboxing security mechanism introduced in Linux kernel 5.13 that allows processes to declare filesystem and network access boundaries at runtime, enforced by the kernel without root privileges. It can be used for defense in depth within containers.
Timeline (last 90 days)
Kernel-level restrictions typically use mechanisms such as seccomp, Landlock, and cgroup to intercept system calls by whitelist or rules when they enter the kernel, making them harder to bypass than application-layer hooks.
Landlock is an unprivileged sandboxing mechanism first introduced in Linux kernel 5.13, and only by 6.2 did it gain complete network and filesystem access control capabilities, which is why OpenShell sets the minimum kernel version at 6.2.
When OpenShell detects that the kernel does not support Landlock, it directly refuses to start the sandbox rather than silently degrading.
All Facts (3)
Kernel-level restrictions typically use mechanisms such as seccomp, Landlock, and cgroup to intercept system calls by whitelist or rules when they enter the kernel, making them harder to bypass than application-layer hooks.
50%UnverifiedLandlock is an unprivileged sandboxing mechanism first introduced in Linux kernel 5.13, and only by 6.2 did it gain complete network and filesystem access control capabilities, which is why OpenShell sets the minimum kernel version at 6.2.
50%UnverifiedWhen OpenShell detects that the kernel does not support Landlock, it directly refuses to start the sandbox rather than silently degrading.
50%