On Fri, Dec 20, 2019 at 11:46:47PM +0100, Mickaël Salaün wrote: > I'm working on a version of Landlock without eBPF, but still with the > initial sought properties: safe unprivileged composability, modularity, and > dynamic update. I'll send this version soon. > > I hope that the work and experience from Landlock to bring eBPF to LSM will > continue to be used through KRSI. Landlock will now focus on the > unprivileged sandboxing part, without eBPF. Stay tuned! Will it end up looking at all like pledge? I'm still struggling to come up with a sensible pledge-like design on top of seccomp, especially given the need to have it very closely tied to the running libc... -- Kees Cook
