Landlock 26.10.6631

Landlock for .NET

A lightweight C# wrapper for the Linux https://landlock.io/ kernel sandboxing feature.

📦 Installation

Add the NuGet package:

dotnet add package Landlock

Or visit: https://www.nuget.org/packages/Landlock

🔍 What is Landlock?

Landlock is a Linux kernel security feature (available since Linux 5.13) that lets unprivileged applications restrict their own filesystem access using an allow-list model. Once a ruleset is enforced, the process—and any child processes—can only access explicitly permitted paths, providing simple but effective sandboxing without requiring root privileges or system-wide configuration.

📌 Library Overview

This library provides a clean and idiomatic C# interface for working with Landlock, allowing you to define filesystem rulesets, grant specific directory or file permissions, and enforce permanent access restrictions at runtime. It is intended for sandboxing plugins, securing file operations, or adding defense-in-depth to applications running on Linux.

🛠️ Usage

using Landlock;

var supported = Landlock.IsSupported();

if (supported)
{
    var sandbox = Landlock.CreateRuleset(Landlock.FileSystem.CORE);

    sandbox.AddPathBeneathRule(
        AllowedDir,
        Landlock.FileSystem.READ_FILE,
        Landlock.FileSystem.READ_DIR
    );

    sandbox.Enforce();
}

This example checks for kernel support, creates a ruleset controlling core filesystem operations, allows read access to a specific directory, and enforces the sandbox so the process cannot access anything outside the allowed paths.

Restricting TCP connections

On Linux 6.7+ (Landlock ABI 4) a ruleset can also handle TCP. Every port not named by a rule is denied:

var sandbox = Landlock.CreateRuleset(
    new[] { Landlock.FileSystem.CORE },
    new[] { Landlock.Network.CONNECT_TCP });

sandbox.AddPathBeneathRule("/usr", Landlock.FileSystem.READ_FILE, Landlock.FileSystem.READ_DIR, Landlock.FileSystem.EXECUTE);
sandbox.AddPortRule(443, Landlock.Network.CONNECT_TCP);

sandbox.Enforce();

Landlock restricts the calling thread and every process it starts afterwards, irrevocably. To confine a child process without confining your application, enforce the ruleset on a dedicated thread and start the process from that thread.

🧪 Requirements

• Linux kernel 5.13+ (6.7+ for TCP port rules), x86_64 or arm64
• .NET 6.0+
• No root privileges required

📝 License

MIT License.

Landlock logo © 2024 by Mickaël Salaün is licensed under CC BY-SA 4.0