Description

Use the landlock Linux Security Module (LSM) to sandbox processes running inside of a Kubernetes Pod.

Goals

Allow users to define which binaries a process is allowed to execute once started within a protected Pod. Moreover, allow user to specify which directories and files the process will have access to, along with the permitted access mode.

Outcome

The project completed successfully. All the source code and documentation can be found here.

Resources

• landlock LSM
• Project's source code
• Project's documentation