Skip to content

add landlock sandbox - #995

Merged
marcospb19 merged 8 commits into
ouch-org:mainfrom
valoq:landlock
Jul 4, 2026
Merged

add landlock sandbox#995
marcospb19 merged 8 commits into
ouch-org:mainfrom
valoq:landlock

Conversation

@valoq

@valoq valoq commented May 19, 2026 •
edited
Loading

Copy link
Copy Markdown
Collaborator

New version of #723

This PR adds landlock filesystem isolation to ouch as discussed in #722
With the new smart unpack by default feature, this is now easy to apply.

Since this is a major feature change and can easily break things, I say this should wait until after a new release has been made and then it can be merged sit in the repo for contributors to test for a while

@valoq valoq mentioned this pull request May 19, 2026
Closed
@valoq
valoq marked this pull request as ready for review June 9, 2026 17:24
@valoq

valoq commented Jun 9, 2026

Copy link
Copy Markdown
Collaborator Author

This PR is now pretty much ready to be tested in practice by anyone interested.

There are still have a few things I want to clean up in the unit tests but the sandbox code itself should be complete now.
The kernel requirement is >= 6.12 and the sandbox isolates the file system not just against file manipulation but also prevents execution and network access.

@valoq
valoq marked this pull request as draft June 12, 2026 12:31
@valoq
valoq marked this pull request as ready for review June 14, 2026 23:00
@valoq

valoq commented Jun 25, 2026

Copy link
Copy Markdown
Collaborator Author

@marcospb19 This should also be ready to merge now.
Since it has still a decent chance of breaking things, I would suggest a new minor release with the recent commit before merging this into main, so it can sit there for a bit while more users test it.

@marcospb19

marcospb19 commented Jun 26, 2026

Copy link
Copy Markdown
Member

I messed up a merge conflict, trying to solve it right now.

@marcospb19

marcospb19 commented Jun 26, 2026

Copy link
Copy Markdown
Member

I'm fixing by resetting to your last good commit, and running a rebase against origin/main, that's why the force push.

marcospb19
marcospb19 requested changes Jun 26, 2026
View reviewed changes
Comment thread src/commands/decompress.rs Outdated
Comment thread src/commands/decompress.rs Outdated
Comment thread src/commands/list.rs
marcospb19
marcospb19 reviewed Jun 26, 2026
View reviewed changes
Comment thread src/commands/decompress.rs
marcospb19
marcospb19 reviewed Jun 26, 2026
View reviewed changes
Comment thread src/commands/list.rs
@valoq
valoq requested a review from marcospb19 June 28, 2026 03:11
@marcospb19

marcospb19 commented Jul 4, 2026 •
edited
Loading

Copy link
Copy Markdown
Member

I would suggest a new minor release with the recent commit before merging this into main

done, 0.8.1 was released, will review

marcospb19
marcospb19 approved these changes Jul 4, 2026
View reviewed changes

@marcospb19 marcospb19 left a comment

Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the review follow ups, looks good now.

It's been almost 2 years since the first landlock draft, a lot changed to make this happen.

Thanks for doing it all 🏆.

@marcospb19
marcospb19 merged commit 77a7fac into ouch-org:main Jul 4, 2026
18 checks passed
@valoq
valoq deleted the landlock branch July 19, 2026 11:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@marcospb19 marcospb19 marcospb19 approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@valoq @marcospb19