@prologic@twtxt.net First, yes, Linux has many features in that area and that’s not a great situation as it complicates everything. 🫤

The two key advantages of landlock (or pledge/unveil) would be: a) Much easier to use / more lightweight, b) usable by non-root users.

Been a while since I watched it, I think this talk by one of the OpenBSD devs was pretty good: https://www.youtube.com/watch?v=gvmGfpMgny4

@movq@www.uninformativ.de Despite the audio sounds like is was recorded with a potato in a bathroom, this is a nice talk! I enjoyed it and learned something.

@lyse@lyse.isobeef.org Yeah, the audio isn’t all too great. 😂

I’m rewatching the talk just now. My main point is still standing: Linux probably has all these features as well, but look at the slides at minute 19:30 and 19:35, pledge and unveil are really easy to use. He didn’t even shorten the code:

https://github.com/openbsd/src/blob/master/usr.bin/nc/netcat.c#L364-L418

unveil this, unveil that, pledge this, pledge that, done. Such a simple, concise, and yet powerful API. You don’t see that very often.

@movq@www.uninformativ.de Oh yes. Compare that with an AppArmor or SELinux profile. Awful! The idea of just putting it right in the program itself sounds very appealing.