Project
A Linux kernel security module that lets an unprivileged process restrict its own filesystem access, inherited by its child processes, via dedicated syscalls.
A dev.to write-up argues that Landlock's unprivileged self-confinement retires the profile-maintenance tax that AppArmor and SELinux impose, though the rules it describes are still paths, so somebody has to enumerate them.
Reality
In this self-hosted pipeline, secret scans and a three-day minimum age on new npm packages run with no model call, and a branch reaches GitHub only after a human clicks approve in the dashboard. The author calls it a developer preview.
Reality
Landlock has been in mainline since kernel 5.13 and needs no policy file and no administrator to confine a process to named paths. The dev.to walkthrough explaining it leaves the enforcing syscall inside a comment.
Reality
Homebrew rated the unsigned cask removal metadata path High and closed it back in 6.0.12. The 7.0.0 upgrade adds one Moderate sandbox escape through LaunchServices, plus a scanner for installed formulae.
Reality
A dev.to write-up traces a build that fails only on enterprise-kernel servers to three correct components meeting badly. The seccomp profile that fixes it stays inert until the build runs on Docker's classic engine.
Reality
Version 7.0.0 adds a brew vulns command that checks installed packages against OSV.dev and Homebrew's own advisory records. The same release drops Intel macOS 11 and later to Tier 3 and stops building bottles for it.
Reality
Landlock has been in mainline Linux since 5.13 and asks no administrator for permission. The dev.to walkthrough that demonstrates it prints a read-only rule under a goal that requires writing.
Reality