OK, hello everyone. Welcome our next speaker, Mikhail. He will be talking about Landlock.
Hello everyone. My name is Miguel Sena. So I'm a cameraman, but I'll show you some
views based off, and it's talk is about using a calculator. We do a develop on the kernel.
But that we use on tool called INANT. So it's about something, and they're able to
help Linux users, them and users, like developers and minors one, to better what
the seekers have or close. So the goal of Python is really to protect users data to
use, but from software programs scripts, that may be big issues or even
exploited by attackers, and that might then do what stuff that you don't want them to do.
Islands uses Landlock, which is a kind of feature. I'll take a module inside the
kernel, and the vanilla kernel. It is in fridge, so any user can use it. It's free,
ready, favorite. And what? There's no risk for the kernel, and it's only about access control.
So you cannot build like containers with it. That's not the goal, but you can restrict
processes within or not within the kernel, whatever. So to make sure that we are on
the same page, the definition of send mixing in this talk is really about
restricting processes, and to be able to control, what to create, control
execution environments, in which all of this is going to be what could be
restricted to any subset of what should be allowed otherwise. So we need to create a second
moment when you can run pretty much interested processes. So now a bit about Landlock.
So Landlock is used by the notification right now. There are some making tools, like set
preview, which is, I guess, one of the more common one. Also in J, Farjian, and other stuff.
And some example of library that you can use, what you use a lot inside applications,
you can use that in Rust, what CF course, go, and then you can use, well, higher
level of application, in C, for instance, with smagell, and well, it was a way to describe
significantly C, like when it's a pillar of a two-up, and there's a Linux library, which
is inspired by that page. And so, I guess, most of you might use a lot, even if you don't
use it, because the idea with Landlock is to make it available to developers and to make
it kind of transparent to users. So, for instance, if you have applications, programs that
have built in sandboxing with Landlock. So, yeah, it can go from desktop applications to archive
manager and network services. So, the key unlock features that we like very
like is that first, it is influenced. So, it means that it is very available to every user
on the Linux system. We need to do not need to ask specific capabilities to be in a
nayspace or whatever. And that has some consequences. And one of these consequences is
instance that, the next one is all season 4. So, it's only lives as long as something
works for this is live. There's no persistence on the first step. And that means what we
don't, we cannot rely on file levels, because we are part of finite data. It is independent
from the kind of restrictions that are hindered by this kind of, so you can use an
lock with SLNX or whatever. And you can create some of this inside some of this, because
this means that you might have your user session, which is sandbox with Landlock. And inside
this session, you might also want to launch different applications that my sandbox
itself, or you might want to create your own sandbox environment. So, and of course,
well, what the cannot gives some security entities. And when it comes to cannot, one
supercess is sandbox. You can escape these sandbox, just as a cannot, just cancel the
sandbox, otherwise that would be useless. And yeah, I also want to allow that
unlock is about access control. So, it is not about changing what possess can
see, but if a possess can access a file on that, if possess can plan a connection to
a size on box or not. And yeah, it really fits to the kind of
semantics. So, it can a little file, so get and possess can understand. And yeah,
what's again, it is ought to go to other kind of mechanisms, like in this
space, access control, see groups, whatever, you can use all together there. And you should
use different mechanisms at the same time. So, how does it work? Well, it is really simple.
You create some box, then you kind of drop some privileges. And whatever you do after that,
we will just buy me a load and not according to what you define earlier. And that is
about times to three-the-digit c-scals. So, it is not not quite true sets. I will
calculate the whole set and then allow for itself to restrict the constraint according to
a given rule set. These are kind of the two which I will go to developers. And that
enabled them to create sandbox was a basic process. And then, once this possesses
sandbox, all the restrictions are inherited across new threads, new processes and new
executions. Right now, there are two kind of restrictions. Some of them are implicit.
Most need to be able to go with that process while buy by sandbox. So, for instance, to
compare to the process, to another process and asking the process to do stuff that
it cannot do itself. And they also exist rights. So, which is a way to express
a security policy for the party's time, network and other kind of IPC mechanisms.
The mainly two use cases. The first one is about integrating some of the thing into
an application to the code of an application in a way that it is kind of transformed to
users. They just use applications. And it is somewhat self. It works. Nothing is visible
and everything is fine. There is no extra coefficient to manage. So, that is why
really well for complex application that deal with interesting data. I like
parser, for instance, web browsers and network services. The second use case is to
sandbox what might be interesting programs. So, in this case, you might not own or
want to change the code of a program, but you still want to restrict its execution.
In this case, you want to create a security environment, sandbox. And then, in this
environment, you launch your new process. So, first of all, you can use it in
systems. They don't have services. Container times, they launch processes. And
sandbox tools. So, in this talk, you talk about a new sandbox tool called
island. Last word, but none of that. It is gaining more and more
feature of a time. It is stepping up. It cannot block anything. Everything
I mean. And it is getting more and more feature of a time with new can
I resist. So, here are a list of what initial features I will
think in the next five to thirteen. And over time, we implemented a new features
more and more stuff. But, of course, it is, well, the developer or the
either that can ask whatever they want to use on that.
Island. Island. So, landlock is a key opportunity, set of three
three-cyst codes. And it is used by developers. But, at the end of the
series, I use it. Well, you might not want to always
to code to just run application and second
environment. So, that is why we need some tools, something
tool, some boxes. And the goal of Python is ready to make it
well, to make unlock easier use for masking
exchanges. So, it act as high level, wrapper, and
policy measure. I learned this time to be able to
use it. But, in this case, mostly using terminal, you see
a little why. And, well, to make it simple to use, to
not think about which commands to last on box nuts. But, to
configure one-self security releases. Well, for one set of
programs, and then to just do you work as you do with
that thing about that. So, the main properties
are, say, there are some boxes, so there is no code
changes from user point of view. It is based on
set of compression files. And, this
computational, which we see later, have good
properties. They are declarative, flexible. And,
made in a way, designed a way that make them easily
shareable with other users, other communities, other
communities, and so on. One of the important
properties of item is that it is kind of context
aware. In actual, it can trigger a sound box on
nuts, according to the working, the
directory you're working with the letter in
a div. And, once a sound box is created, it is
not only about unlock restrictions, but also about
the stuff, which are useful for applications.
For instance, set in the variable and pair,
set of file keys, which I did in the
person box. So, let's see the demo to make it
a bit more clear. In this case, so, I
installed island. You'll see later what
there's all the documentation on the GitHub. And,
what do you want to point is that I'm using
the div h, because there's some hook,
implemented for this pithic shell, which
make it possible. So, I'm simple user.
I have a few projects. I don't have any
profile, sound box profile yet, but I have a few
projects. So, let's say, well, I have the
few projects. And, I want to create a sound box
profile for whatever I will do in this project.
And, well, there might have some dependency. So,
let's say, there's the bar directory, which is
also part of this project. So, this is going to
create a new island profile. So, it will just
create a few files on the home user home directory
that will describe a sound box with default properties.
And, then, after that, we can change this file of course.
In this case, it's pretty simple. Just create new
profile in this sound box. And, in this case, we
specify two vectors. Well, by default, if you
don't have a dashp, b is means a
pinif. So, a file pinif, the directory. If you
don't specify that, by default, take the
turn-down thing directory. But, in this case,
I want to add two vectors. So, the current one
projects through. And, the project bar directory.
So, I create that. So, the file I create it in this
directory, you can see. And, the sound box
will be applied for the true
directory's identifying. And, because I'm already in
one of them. And, the D discharge hooks are
already enforced. Well, the sound box is
really the balance. This not lunch yet, which
means the shell is not sound box itself. But,
every command that I will launch from this
directory will be automatically
sandboxed with the profile I just created. So,
in practice, and by default, the
default profile is created. Although,
executing whatever you install in
the system. So, whatever is in
slash, there's a pin.
Pin stands. And, you can
must write on the directory, which has
tied to this profile. In this case,
the true and the bar
directory. So, I can see with the
controller directory. That's good.
I have make file. But, for instance,
I cannot see the content of the
primary directory. Right? So,
so, the visual and how it works is that
when L.S. is launched, it creates a new
process. And, this process is automatically
sandboxed by iLent on the fly. And,
because this unvaccinated access
processes outside of the free directory,
what it cannot open the directory. But,
if I want to do, because I
trust myself. And, I trust my
shell. I can go outside of the
directory and do whatever I want to.
Again, get back and see what's inside,
and so on. And, whenever I jump
into a directory, which is
configured to be sandboxed, everything
that I will launch is a directory,
will be sandboxed. And,
if instance, well, let's say, I just
download a project somewhere,
an appendix with one. I do not read
the meg file. But, I still want to
build it. Well, in this case, I will get some error.
And, that might be with.
Bit with. Well, it's a bit explicit for
the demo, but it's in the
initial. What does this
meg file, that reads your
practices key? So, of course, the real
attack will not be that explicit,
it will be, like, released. And, just
sleep yours, it's key. So, network,
but that the idea. And, in this case,
well, that is blocked, because
cut, well, make is launched in
a sandbox automatically. And,
anything which is launched by
make, in this case, cut, cannot
read what's outside of the sandbox.
And, if I do the same with the
daily, which is not sandbox, and
here, if I have the same, make
file, of course,
well, that we just dump my
prerequisites key. Okay.
And, how does it work? And, does it work
with a programming tool? The thing is,
it's not just only create
sandbox with analog, but it
creates a very nice action
environment. And, that includes
instance, a few
variables which are set, which are
dedicated per sandbox. In this case,
you'll see, um,
for instance, this XG
internal variables are set for
the specific sandbox. So, you can see
project FUBA here, which I created.
That's the same for the
conversion files by default. So, that
should be used by most modern applications,
most modern programs. And, uh,
yeah, for some data and some other stuff.
And, also, in the case for, uh,
the GP directory. So, um,
basically, the directory, which is
20, pass on box,
45s, um, and the byte will
can be accessed. But, of course,
if you just want to read the,
what, if the shell reads this
environment viable, it will not
get a similar view, because it's not
some, but itself, right?
So,
and this work is the end program,
is launched and then some box. So,
gets a different set of environment
variables. That's why, how it works
well, and it's kind of a really deep
to us kind of environments.
Um, and, yeah,
in our shell, the configuration, um,
uh, files are here. So, you set a new
directory, the project.
Injectory, you have, uh, a file
that defines what, when this
box will be active data not,
and then you have, um, a file
to define safety rules,
and then you have set of siblings,
which can be changed to footage
which if you want, that are, by
give or create it, uh, for this
specific sandbox.
Okay, so, I'll go,
quickly through doctrinal limitations.
Um, so why not, if you're
reading that on, um,
let's hear recent more than
desktop, you might not have full
resolution, because there are some
use services that might be
code, but any processes,
insights is session. Um,
and that same for topics, because what,
we can use, uh, so gets to,
cool this kind of stuff, and as you
could also have some docs. So, um,
that's okay. That will be handled, um,
with upcoming innovations. Um,
yeah. So, the thing is,
now we can get more and more
of it over time, uh, but it's really interesting
to have this kind of feature, to get ready,
to use it, to get your own profiles,
and scale policies. Um, and even if,
well, even for normal use cases,
without running malicious, uh,
all-interested processes, programs,
uh, in my view, to create, uh,
simple environment for the
automatically, uh, you on caution files,
or you on, uh, build system,
or whatever you want. Um,
I'd go with it quickly on the
non-lock coffee, five formats,
so that the format you use to define a
signal policy. Um,
so in cell,
you can have set of variables to make it
kind of flexible, and then
define set of files that
through, uh, my wants to allow
to in this case, um,
slash V, and so on, to be able to, uh,
read and execute the content of
the five guarantees.
And also five, uh,
uh, fact is that you want to be able to
read and write and to them, so
when it's time to temp the
factories, and, um,
but,
so yeah, there's a full
recommendation for that. Um,
there are really nice properties, uh,
you can share
these files, uh,
these declarative,
the remedies, and we can create
independent, uh,
configurations, and it's, yeah,
initially flexible, uh,
uh, please,
can compose them, which is, uh,
kind of specific, but pretty useful if you want to share them again.
Um,
and yeah, so times up,
I wrap up, you can try
islands, uh,
I would just give you a
critical letter, uh,
that's a few lines you have to type to
install it for your user session.
Uh, here's how
islands design to protect you,
protect users that want to be protected.
Um, it's dedicated to Linux users,
and the idea is to make it easy
to use enough to think about something
when you compute, uh,
just single policies.
That's it.
Thank you.
We've got two minutes for a question.
So, you want to see first?
Uh, so is it based
through the current working directory of
the process that's being launched?
So, for example, if you are in the parent directory of
the directory that contains that make file,
and you do like make dash
at, you know, and then, you know,
the sub-director, so you're outside the island,
but then the files inside the island,
it's the current,
the actual policy being applied to the process,
based on the current working director,
which is outside the island, correct?
Yeah. So, the idea that the user
is, it's, it's twisted because
you want to protect itself,
and so that's the way to make it easy to use
sandbox. So, another way to the island is to,
to go island, run, and your program,
but by default, to whitewalk, see that,
just taking to account,
the shell, the shell, taking to account,
the current working directory,
and according to the directory,
look for an existing sandbox for file
that matches the directory.
So, whatever you launch,
when, in your shell, you are in
the directory with these sandbox,
if you launch it, outside of the directory,
it will not be the sandbox,
by default, I mean.
Okay, so, in that case,
like, in practice, you would probably want to go into that,
your island directory,
and then run your shell,
and then you're properly isolated for every.
Yeah, but you want to, yeah,
the idea is to go to your workspace for your project,
and do that, do whatever you want,
you need to build whatever,
and then switch on the directory,
and it will do what he switch on as a profile.
Thank you.
Thank you very much.
How well does it integrate with
like system processes,
and in particular, can I use it
to ditch like protected systems
as a second base,
and run my system services,
the system D was island.
So, with that,
the working question to integrate
a non-lock within system D,
using the same coefficient of five formats.
But, it is not based on island,
island is only the sandbox at two,
and the system D will use,
well, the idea is to make it use the same five formats,
but not island,
because island is only part,
use the fishing interface.
Okay, so we are out of the line.
Thank you for the question.
Thank you for the dog.
Thank you.