@landstrip/landstrip 0.16.6 → 0.16.7
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +18 -1
- package/package.json +5 -5
package/README.md
CHANGED
|
@@ -1,3 +1,6 @@
|
|
|
1
|
+
<!-- SPDX-License-Identifier: GPL-3.0-or-later -->
|
|
2
|
+
<!-- Copyright (C) Jarkko Sakkinen 2026 -->
|
|
3
|
+
|
|
1
4
|
# landstrip
|
|
2
5
|
|
|
3
6
|
`landstrip` runs a tool in an OS-level sandbox using Landlock LSM on Linux,
|
|
@@ -28,7 +31,21 @@ binary package.
|
|
|
28
31
|
| TCP | localhost proxy ports | loopback proxy ports | allow all or deny all |
|
|
29
32
|
| Unix sockets | allowlist | allowlist via seccomp broker | allow all or deny all |
|
|
30
33
|
|
|
31
|
-
###
|
|
34
|
+
### Linux
|
|
35
|
+
|
|
36
|
+
Landlock carves the denied subtrees out of the allowed roots, and then grants
|
|
37
|
+
`PATH_BENEATH` rules only for the surviving fragments. The denied path is never
|
|
38
|
+
added to the ruleset, and the kernel enforces the path in-process.
|
|
39
|
+
|
|
40
|
+
Seccomp is applied when a policy needs more than Landlock can express
|
|
41
|
+
statically, e.g. for many filesystem mutator syscalls, or when denials must be
|
|
42
|
+
reported back to the launcher. The broker intercepts `openat`/`openat2` via
|
|
43
|
+
seccomp user-notifications, resolves the real path, and validates it
|
|
44
|
+
|
|
45
|
+
Finally there's some logic to deduce that Landlock and Seccomp (mostly for
|
|
46
|
+
mutator syscall, which take fd) are fairly disjoint entities.
|
|
47
|
+
|
|
48
|
+
### Windows
|
|
32
49
|
|
|
33
50
|
Win32 API provides AppContainer for application level sandboxing. The platform
|
|
34
51
|
creates a per-run LPAC AppContainer profile, grants its SID access to the lowered
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@landstrip/landstrip",
|
|
3
|
-
"version": "0.16.
|
|
3
|
+
"version": "0.16.7",
|
|
4
4
|
"description": "Sandbox runner using Landlock, Seatbelt, and AppContainer",
|
|
5
5
|
"license": "Apache-2.0 AND LGPL-2.1-or-later",
|
|
6
6
|
"homepage": "https://github.com/landstrip/landstrip#readme",
|
|
@@ -24,10 +24,10 @@
|
|
|
24
24
|
"LICENSE-LGPL-2.1"
|
|
25
25
|
],
|
|
26
26
|
"optionalDependencies": {
|
|
27
|
-
"@landstrip/landstrip-darwin-arm64": "0.16.
|
|
28
|
-
"@landstrip/landstrip-darwin-x64": "0.16.
|
|
29
|
-
"@landstrip/landstrip-linux-x64": "0.16.
|
|
30
|
-
"@landstrip/landstrip-win32-x64": "0.16.
|
|
27
|
+
"@landstrip/landstrip-darwin-arm64": "0.16.7",
|
|
28
|
+
"@landstrip/landstrip-darwin-x64": "0.16.7",
|
|
29
|
+
"@landstrip/landstrip-linux-x64": "0.16.7",
|
|
30
|
+
"@landstrip/landstrip-win32-x64": "0.16.7"
|
|
31
31
|
},
|
|
32
32
|
"publishConfig": {
|
|
33
33
|
"access": "public"
|