From: "Mickaël Salaün" <mic@digikod.net>
To: landlock@lists.linux.dev
Cc: oss-security@lists.openwall.com,
linux-security-module@vger.kernel.org, lwn@lwn.net
Subject: Island: Sandboxing tool powered by Landlock
Date: Fri, 5 Dec 2025 12:22:28 +0100 [thread overview]
Message-ID: <20251205.saiZ2Pauleew@digikod.net> (raw)
Hi,
I just released Island, a sandboxing tool powered by Landlock:
https://github.com/landlock-lsm/island
Island makes Landlock practical for everyday workflows by acting as a
high-level wrapper and policy manager. Developed alongside the kernel
feature and its Rust libraries, it bridges the gap between raw security
mechanisms and user activity through:
- Zero-code integration: Runs existing binaries without modification.
- Declarative policies: Uses TOML profiles instead of code-based rules.
- Context-aware activation: Automatically applies security profiles
based on your current working directory.
- Full environment isolation: Manages isolated workspaces (XDG
directories, TMPDIR) in addition to access control.
- Transparent shell integration: Automatically sandboxes commands in
your shell without changing your workflow.
- Zero-privilege operation: No root access or special capabilities
required.
- Layered protection: Multiple profiles compose cleanly with
deterministic ordering.
It's a work in progress, so be careful.
Feedback welcome!
Regards,
Mickaël
next reply other threads:[~2025-12-05 13:27 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2025-12-05 11:22 Mickaël Salaün [this message]
[not found] ` <303DA753-37EF-4530-AA63-4C3579E9A454.1@smtp-inbound1.duck.com>
2025-12-05 12:35 ` [oss-security] Island: Sandboxing tool powered by Landlock kf503bla
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20251205.saiZ2Pauleew@digikod.net \
--to=mic@digikod.net \
--cc=landlock@lists.linux.dev \
--cc=linux-security-module@vger.kernel.org \
--cc=lwn@lwn.net \
--cc=oss-security@lists.openwall.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).