f:"$Sreact.suspense" 10:I[2470,["2044","static/chunks/891cff7f-1cf899dcf8fb5382.js","6340","static/chunks/6340-6b10c73f79302700.js","4387","static/chunks/4387-45db143a909e66bd.js","1538","static/chunks/1538-7546036eab9abc17.js","1919","static/chunks/1919-ef4c5b616d044cab.js","1395","static/chunks/1395-120c93fee6fe2585.js","758","static/chunks/758-b1a6178a4f43e305.js","3602","static/chunks/3602-82634beb242f5d09.js","6187","static/chunks/6187-1fa181283bb9c476.js","963","static/chunks/963-4e72f4f3c29ae566.js","7462","static/chunks/7462-0529a987ae30bc57.js","1791","static/chunks/1791-58d3bfb1c9217742.js","2213","static/chunks/2213-1086d747374bd80c.js","3876","static/chunks/app/post/%5Bcode%5D/page-7136cd7e0b9669b9.js"],"PostPageClient"] 11:T46f,

I was looking through the upcoming Go 1.28 changes and found the new Landlock support in syscall.SysProcAttr interesting.

It lets Go apply a Landlock ruleset to a subprocess without restricting the parent process. We still need to create the ruleset ourselves, but we no longer need a separate launcher just to apply it to the child.

I wrote a short article with a runnable example that blocks directory creation in the subprocess while allowing it in the parent.

It's based on the development version of Go 1.28, so the API may still change before release.

https://abdolirad.me/articles/go-1-28-landlock-subprocess-sandboxing/

submitted by /u/atkrad
[link] [comments]

Menu

Sandboxing subprocesses with Landlock in Go 1.28