Repolode
Предложить
Zouuup

Zouuup/landrun

A lightweight CLI that runs any Linux process in an unprivileged sandbox using Landlock, with fine-grained filesystem and network controls.

Open source альтернатива:Firejail

Открыть на GitHub
Звёзды
2,322
Форки
55
Открытые issues
4
Последний коммит
6 дней назад

Что это?

Landrun is a command-line tool that runs a Linux process inside a sandbox built on Landlock, a kernel-native security module that lets unprivileged processes restrict themselves. It requires no root privileges, no containers, and no SELinux or AppArmor policy files. You wrap a command with landrun and list the paths and ports it may use.

Access rules are set per path with flags such as --ro, --rw, --rox and --rwx, and per port with --bind-tcp, --connect-tcp, --bind-udp and --connect-udp. The tool also covers pathname UNIX socket connections, abstract UNIX socket and signal scoping, and audit logging of Landlock denials. Support depends on the kernel: TCP restrictions need Linux 6.7 or later, and UDP restrictions need 7.2 or later. The --best-effort flag lets it fall back to the features an older kernel supports.

If no rules are given and no unrestricted flag is set, landrun denies all access. Environment variables are not passed to the child process unless requested with --env.

Ключевые возможности

  • 01Runs any Linux command in a Landlock sandbox without root or containers.
  • 02Controls read, write and execute access per file or directory.
  • 03Restricts TCP and UDP bind and connect operations by port or port range.
  • 04Supports pathname UNIX socket access control and IPC scoping.
  • 05Logs Landlock denials for auditing, on supported kernels.
  • 06Uses --best-effort to degrade gracefully on older kernels.

Сценарии использования

  • Confining an untrusted build step, script or third-party binary so it cannot read secrets or reach the network.
  • Running a web server or daemon with access limited to its config, log and web root directories.
  • Restricting a CLI tool to specific ports or a single database socket.
  • Hardening systemd services without writing a full container or MAC policy.

Темы

#sandbox#landlock#linux#security#process-isolation#cli#least-privilege#golang#kernel#sandbox-environment

Частые вопросы

Что такое landrun?
A lightweight CLI that runs any Linux process in an unprivileged sandbox using Landlock, with fine-grained filesystem and network controls. Landrun is a command-line tool that runs a Linux process inside a sandbox built on Landlock, a kernel-native security module that lets unprivileged processes restrict themselves. It requires no root privileges, no containers, and no SELinux or AppArmor policy files. You wrap a command with landrun and list the paths and ports it may use.
landrun можно использовать бесплатно? Какая у него лицензия?
landrun распространяется с открытым исходным кодом под лицензией MIT. Перед использованием в коммерческих продуктах проверьте условия лицензии.
landrun всё ещё поддерживается?
Активно поддерживается. Последний коммит в landrun — 16 окт. 2026 г..
Для чего можно использовать landrun?
Confining an untrusted build step, script or third-party binary so it cannot read secrets or reach the network. Running a web server or daemon with access limited to its config, log and web root directories. Restricting a CLI tool to specific ports or a single database socket. Hardening systemd services without writing a full container or MAC policy.
Где скачать landrun?
Исходный код и инструкции по установке — на GitHub: https://github.com/Zouuup/landrun

Описание создано ИИ на основе README проекта. Статистика GitHub обновляется ежедневно.

Похожие проекты