Hello everyone,
After looking into many Linux sandboxing tools, I've found that some of them don't prevent applications which are granted Internet access from accessing the local network, because doing so without CAP_NET_ADMIN requires a userspace network stack (slirp4netns or pasta).
Since Landlock already does some network access control, and work is ongoing to add more (#6, #10, #57), I'd like to know what you think about the idea of creating a Landlock rule to only allow network traffic that any other computer directly or indirectly connected to the Internet could send.
Hello everyone,
After looking into many Linux sandboxing tools, I've found that some of them don't prevent applications which are granted Internet access from accessing the local network, because doing so without
CAP_NET_ADMINrequires a userspace network stack (slirp4netns or pasta).Since Landlock already does some network access control, and work is ongoing to add more (#6, #10, #57), I'd like to know what you think about the idea of creating a Landlock rule to only allow network traffic that any other computer directly or indirectly connected to the Internet could send.