Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

Where/how was landlock supposed to be used?

I guess you cannot really use it in a generic library like compression/decompression. The library has no clue what the program is supposed to do and what should be restricted.

For a program it might be clearer.

The sshd attack was using liblzma as a library. So disabling landlock seems unrelated? A sign that there is more bad code waiting to be detected / had been planned to be inserted???




Presumably sshd itself used to lock down its own capabilities after a certain point of execution.

Removing the landlock means the daemon doesn’t lock itself down and will allow for better payload execution when they get to the exploitation stage.

I don’t think these two things are unrelated. I think they already had payloads in mind and realized this would be a hurdle.


No. OpenSSH doesn't use Landlock, and even if it did, this patch wouldn't affect it.


It's pretty impossible to lock down sshd. The restrictions are inherited by all ancestors. What would the sysadmin say if they find themselves in a restricted shell?


Providing answers to things you have no clue about is worse than providing no answer at all.


Its weird. Like i would consider doing two unrelated backdoor-esque things in the same project really sloopy. Seems like it just significantly increases the risk of being discovered for minimal gain.

Its very confusing. Parts of this sega seem incredibly sophisticated while other parts seem kind of sloppy.


Dude is a developer just like the rest of us. We all try to write clever code from time to time, but at other times write sloppy crap. Especially if there's a boss insisting on a tight deadline.


You can use it and it's a good idea, although it's meant to stop exploits rather than deliberate backdoors.

The idea is that the library starts a separate thread to do any complex operation and then waits for it in the API call the user code made. The thread landlocks itself and then begins the operation. If something goes wrong the code is confined.

Of course in this case it doesn't work because the sandbox is controlled by the attacker, so they can just turn it off or make it weaker than it should be. But you can also do things other ways.




Consider applying for YC's Fall 2025 batch! Applications are open till Aug 4

Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: