landrun mit Homebrew, Nix installieren

Projektlinks

• Homepage

Befehle und Aliase

• landrun

Projektgeschichte

The project appeared publicly in March 2025 with early 0.1.x releases. Its README frames it as a practical front end for Landlock: no root, no containers, no SELinux or AppArmor policy files, and a command-line flag model for read, write, execute, bind, and connect permissions.

The early release stream quickly refined the access model. Version 0.1.3, released on 2025-03-22, added a deny-all behavior when no sandbox rules are provided. Version 0.1.4, released on 2025-03-23, replaced a global execution flag with path-specific execution permissions. Version 0.1.10, released on 2025-03-23, expanded Landlock permission coverage and tests, and version 0.1.14, released on 2025-04-03, added helper flags for dynamically linked executables.

Adoptionsgeschichte

Landrun's adoption signal is mainly package-nerd and security-tool visibility rather than a long institutional history. The upstream README lists distro packaging for Arch AUR and SlackBuilds, and the Homebrew formula places it in the macOS/Linux package-manager ecosystem even though the underlying sandbox requires Linux Landlock support.

Wie es verwendet wird

Typical usage is to prefix another command with `landrun` and add only the paths and TCP ports that process should access. The README also documents a systemd integration pattern for wrapping services such as nginx with reduced filesystem and network permissions.

Warum Paket-Nerds sich dafür interessieren

For package collectors, Landrun is notable because it turns a relatively obscure kernel LSM into a normal CLI tool. It sits near tools such as firejail and bubblewrap, but its hook is using unprivileged, kernel-native Landlock rules with a small Go implementation.

Zeitleiste

• 2025-03-22: v0.1.3 release documented deny-all behavior when no sandbox rules are supplied.
• 2025-03-23: v0.1.4 release introduced path-specific execution permissions.
• 2025-03-23: v0.1.10 release expanded Landlock permission coverage and test coverage.
• 2025-04-03: v0.1.14 release added `--ldd` and `--add-exec` helper flags.

Related projects

• Related projects include the Linux Landlock LSM, the go-landlock bindings used by Landrun, and user-facing Linux sandbox tools such as firejail and bubblewrap.

Quellen

• https://github.com/Zouuup/landrun
• https://github.com/Zouuup/landrun/releases