py-landlock

Python bindings for the Linux Landlock security module.

Landlock is a Linux kernel feature that enables unprivileged processes to restrict their own access to the filesystem, network, and IPC resources. This library provides both a high-level API for common use cases and low-level access to the underlying syscalls.

Requirements

• Python 3.10 or later
• Linux kernel 5.13 or later with Landlock enabled
• Supported architectures: x86_64, aarch64

Installation

pip install py-landlock

Or with uv:

uv add py-landlock

Examples

Quick Start

from py_landlock import Landlock

Landlock() \
    .allow_read("/usr", "/etc") \
    .allow_execute("/usr/bin") \
    .apply()

# Any attempt to write or access other paths now raises PermissionError

Check Availability

from py_landlock import get_abi_version, LandlockNotAvailableError

try:
    version = get_abi_version()
    print(f"Landlock ABI v{version}")
except LandlockNotAvailableError as e:
    print(f"Not available: {e}")

Sandbox with Network Restrictions

from py_landlock import Landlock

Landlock() \
    .allow_read("/usr", "/etc") \
    .allow_read_write("/tmp/myapp") \
    .allow_network(443, bind=False, connect=True) \
    .apply()

For more examples, see the examples/ directory.

Usage

High-Level API

The Landlock class provides a fluent builder interface for constructing and applying security policies.

Filesystem Access Control

Network Access Control

Network restrictions require kernel ABI version 4 or later.

Scope Restrictions

Scope restrictions limit IPC and signal delivery to processes within the same Landlock domain. Requires kernel ABI version 6 or later.

Strict vs Best-Effort Mode

By default, the library operates in strict mode and raises CompatibilityError if a requested feature is not supported by the running kernel. Use Landlock(strict=False) for best-effort mode which silently ignores unsupported features.

ABI Compatibility

Landlock uses ABI versioning to maintain backward compatibility as new features are added. The kernel's ABI version determines which access rights are available:

Low-Level API

For advanced use cases, the library exposes the underlying syscall wrappers:

from py_landlock import (
    create_ruleset,
    add_rule,
    restrict_self,
    RulesetAttr,
    PathBeneathAttr,
    AccessFs,
)

attr = RulesetAttr()
attr.handled_access_fs = AccessFs.READ_FILE | AccessFs.WRITE_FILE
ruleset_fd = create_ruleset(attr)

path_attr = PathBeneathAttr.from_path("/tmp", AccessFs.READ_FILE | AccessFs.WRITE_FILE)
add_rule(ruleset_fd, path_attr)

restrict_self(ruleset_fd)

Error Handling

Threading

Landlock rules apply to the calling thread and are inherited by all threads and processes it creates afterward. Key behaviors:

• Rules cannot be removed once applied
• Each thread can add additional restrictions to itself
• Child threads and processes inherit all restrictions from their parent
• A thread cannot relax restrictions inherited from its parent

Limitations

Landlock has several limitations documented in the kernel documentation:

• Filesystem topology: Sandboxed threads cannot modify filesystem topology via mount(2) or pivot_root(2). However, chroot(2) is permitted.

• Special filesystems: Files from non-user-visible filesystems (such as pipes and sockets) accessible through /proc/<pid>/fd/* cannot be explicitly restricted. Special kernel filesystems like nsfs also cannot be directly restricted.

• Ruleset stacking limit: A maximum of 16 stacked rulesets can be applied. Once this limit is reached, restrict_self() returns E2BIG. This can be problematic for programs that launch other sandboxed programs.

• IOCTL restrictions: The IOCTL_DEV access right only applies to device files opened after the ruleset is applied. Pre-existing file descriptors (stdin, stdout, stderr) are unaffected.

• Network restrictions: Only TCP bind and connect operations can be restricted. UDP, ICMP, and other protocols are not covered.

Resources

• Landlock website
• Linux kernel documentation
• rust-landlock - Rust bindings
• go-landlock - Go bindings

License

MIT