Linux Landlock LSM lets users sandbox apps without root privileges

Landlock is a Mandatory Access Control technology built into the Linux kernel as a Loadable Security Module, designed to let any user create sandbox policies without requiring administrator rights. It allows users to specify exactly which files and network resources an application can access, reducing the attack surface of potentially untrusted software. Unlike existing tools such as AppArmor, SELinux, or Firejail, Landlock requires no complex configuration or elevated privileges to deploy. The feature works by defining access rulesets that the kernel enforces at the syscall level, returning a simple 'Permission denied' if an app attempts unauthorized access. Practical tools like landconfine and the C library liblandlock make it straightforward to apply these restrictions to everyday applications such as web browsers or document viewers.