CME-506
Landlock LSM (Filesystem Sandboxing)
Description
Linux Security Module that allows unprivileged processes to restrict their own filesystem access. Process voluntarily drops access to paths it does not need, reducing impact of compromise.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Scope (S) | C → U | Process cannot access filesystem paths outside its Landlock ruleset |
| Confidentiality (C) | H → L | File read access restricted to declared paths |
CWE Relationships
Verification
Check if process has active Landlock restrictions
$ grep Landlock /proc/self/status
# Expected: Landlock
# Expected: Landlock
Platform: linux