Landlock LSM lets Linux users sandbox apps without root privileges

Landlock is a Linux Security Module introduced in kernel version 5.13 that allows any process to strictly restrict its own access to files and network objects without requiring root privileges. Unlike traditional MAC systems such as SELinux or AppArmor, Landlock uses simple path-based rules rather than complex policies, making it accessible to regular users and developers. Once restrictions are applied to a process, they cannot be expanded or bypassed by child processes, providing strong containment guarantees. The module addresses a longstanding gap in Linux security tooling, where existing sandboxing options either demanded administrator involvement or required significant configuration overhead. Practical use cases include isolating browsers, running untrusted scripts, and protecting sensitive directories like SSH keys from unauthorized access.