{"categories":[{"label":"Python Modules","url":"https://skillfed.io/packages/category/software-development-libraries-python-modules/6"},{"label":"Security","url":"https://skillfed.io/packages/category/security"},{"label":"Linux","url":"https://skillfed.io/packages/category/system-operating-system-kernels-linux"}],"enrichment":{"capability":"Landlock provides a Python interface to Linux's Landlock security module, enabling rule-based file system access restrictions to harden applications against unauthorized file access.","skillfed_tags":["linux-security","sandboxing","access-control"],"use_cases":["Harden HTTP or file servers to prevent symlink escapes and restrict access to a single directory.","Sandbox untrusted or third-party Python code to limit file system damage if it is compromised.","Protect sensitive application data by restricting access to configuration or credential files.","Enforce principle of least privilege in multi-tenant or containerized deployments.","Mitigate accidental file access bugs by explicitly declaring which paths an application may touch."],"what_it_does":"Landlock is a Python wrapper around the Linux Landlock security module, which lets you restrict file system access at runtime by defining allow/deny rules. You create a Ruleset, specify which paths are accessible, call apply(), and from that point forward the process and its children cannot read, write, or interact with files outside the allowed set\u2014even through symlinks or other escape routes. It supports Landlock ABI versions 1, 2, 3, and 5, covering initial access control, file renaming/linking, truncation, and device IOCTL operations.\n\nThe package is useful for hardening long-running services (like HTTP servers) against both accidental programming mistakes and exploits. If a vulnerability is discovered in your application, Landlock can prevent the attacker from reading sensitive files or accessing the full file system. It won't stop all malicious behavior, but it significantly raises the bar for post-exploitation damage. The implementation is straightforward: define rules declaratively, apply them once, and the kernel enforces them thereafter.","worth_installing":"Yes, if you run Python on Linux and need file system sandboxing. The package is actively maintained, has no dependencies, installs easily, and solves a real security problem. The main constraint is that it requires Linux with Landlock kernel support (available in recent kernels) and Python >=3.9. Not applicable on other operating systems."},"id":"landlock","links":{"html":"https://skillfed.io/packages/landlock","md":"https://skillfed.io/packages/landlock.md","pypi":"https://pypi.org/project/landlock/"},"maintenance":{"status":"active"},"meta":{"latest_release":"2025-05-03","license_spdx":null,"license_treatment":"permissive","name":"landlock","python_support":"supports_current","summary":"Python interface to the Landlock Linux Security Module."},"popularity":{"monthly_downloads":1724754,"position":3612,"tier":"top_5000"},"security":{"n_vulnerabilities":0},"version":"1.0.0.dev5"}