@landstrip/landstrip 0.16.6 → 0.16.7

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (2) hide show
  1. package/README.md +18 -1
  2. package/package.json +5 -5
package/README.md CHANGED
@@ -1,3 +1,6 @@
1
+ <!-- SPDX-License-Identifier: GPL-3.0-or-later -->
2
+ <!-- Copyright (C) Jarkko Sakkinen 2026 -->
3
+
1
4
  # landstrip
2
5
 
3
6
  `landstrip` runs a tool in an OS-level sandbox using Landlock LSM on Linux,
@@ -28,7 +31,21 @@ binary package.
28
31
  | TCP | localhost proxy ports | loopback proxy ports | allow all or deny all |
29
32
  | Unix sockets | allowlist | allowlist via seccomp broker | allow all or deny all |
30
33
 
31
- ### Windows AppContainer
34
+ ### Linux
35
+
36
+ Landlock carves the denied subtrees out of the allowed roots, and then grants
37
+ `PATH_BENEATH` rules only for the surviving fragments. The denied path is never
38
+ added to the ruleset, and the kernel enforces the path in-process.
39
+
40
+ Seccomp is applied when a policy needs more than Landlock can express
41
+ statically, e.g. for many filesystem mutator syscalls, or when denials must be
42
+ reported back to the launcher. The broker intercepts `openat`/`openat2` via
43
+ seccomp user-notifications, resolves the real path, and validates it
44
+
45
+ Finally there's some logic to deduce that Landlock and Seccomp (mostly for
46
+ mutator syscall, which take fd) are fairly disjoint entities.
47
+
48
+ ### Windows
32
49
 
33
50
  Win32 API provides AppContainer for application level sandboxing. The platform
34
51
  creates a per-run LPAC AppContainer profile, grants its SID access to the lowered
package/package.json CHANGED
@@ -1,6 +1,6 @@
1
1
  {
2
2
  "name": "@landstrip/landstrip",
3
- "version": "0.16.6",
3
+ "version": "0.16.7",
4
4
  "description": "Sandbox runner using Landlock, Seatbelt, and AppContainer",
5
5
  "license": "Apache-2.0 AND LGPL-2.1-or-later",
6
6
  "homepage": "https://github.com/landstrip/landstrip#readme",
@@ -24,10 +24,10 @@
24
24
  "LICENSE-LGPL-2.1"
25
25
  ],
26
26
  "optionalDependencies": {
27
- "@landstrip/landstrip-darwin-arm64": "0.16.6",
28
- "@landstrip/landstrip-darwin-x64": "0.16.6",
29
- "@landstrip/landstrip-linux-x64": "0.16.6",
30
- "@landstrip/landstrip-win32-x64": "0.16.6"
27
+ "@landstrip/landstrip-darwin-arm64": "0.16.7",
28
+ "@landstrip/landstrip-darwin-x64": "0.16.7",
29
+ "@landstrip/landstrip-linux-x64": "0.16.7",
30
+ "@landstrip/landstrip-win32-x64": "0.16.7"
31
31
  },
32
32
  "publishConfig": {
33
33
  "access": "public"