Landlock support landed into Emilua

Landlock support landed into Emilua

[Vinícius dos Santos Oliveira]

Emilua 0.5.0 was released with Landlock support:
https://docs.emilua.org/api/0.5/changelog.html

Emilua is an execution engine with support for async IO for LuaJIT. It
allows the creation of concurrent Lua programs. It also supports
running separate Lua VMs for extracting parallelism.

Starting from the previous version, it added the ability to spawn Lua
VMs in their own processes isolated in their own Linux namespaces for
sandboxing purposes. However Linux namespaces are too convoluted and
it became clear how inappropriate they really are to just create
sandboxes.

Starting from the just newly released version, Landlock and Capsicum
were added as alternatives to Linux namespaces.


-- 
Vinícius dos Santos Oliveira
https://vinipsmaker.github.io/

Re: Landlock support landed into Emilua

[Günther Noack]

Hello Vinícius,

On Mon, Dec 04, 2023 at 08:55:41AM -0300, Vinícius dos Santos Oliveira wrote:
> Emilua 0.5.0 was released with Landlock support:
> https://docs.emilua.org/api/0.5/changelog.html
> 
> Emilua is an execution engine with support for async IO for LuaJIT. It
> allows the creation of concurrent Lua programs. It also supports
> running separate Lua VMs for extracting parallelism.
> 
> Starting from the previous version, it added the ability to spawn Lua
> VMs in their own processes isolated in their own Linux namespaces for
> sandboxing purposes. However Linux namespaces are too convoluted and
> it became clear how inappropriate they really are to just create
> sandboxes.
> 
> Starting from the just newly released version, Landlock and Capsicum
> were added as alternatives to Linux namespaces.

This looks great, thanks for sharing!

I am not very proficient in Lua, but I a appreciate your well-written
introduction into sandboxing in your documentation (and also that you
are quoting Xkcd 1200 ;-))

Please do not hold back feedback if you run into any surprises or
questions!

–Günther

Re: Landlock support landed into Emilua

[Vinícius dos Santos Oliveira]

Em ter., 5 de dez. de 2023 às 03:09, Günther Noack
<gnoack3000@gmail.com> escreveu:
> Please do not hold back feedback if you run into any surprises or
> questions!

I'm just waiting for the ability to have more isolation so I can use
it in serious applications.

So far the API has been looking good, and I liked seeing Capsicum
plans in the roadmap.


-- 
Vinícius dos Santos Oliveira
https://vinipsmaker.github.io/