{"id":29226,"date":"2026-09-12T20:33:52","date_gmt":"2026-09-12T20:33:52","guid":{"rendered":"https:\/\/umang.pk\/2026\/09\/12\/%d9%84%db%8c%d9%86%da%88-%d9%84%d8%a7%da%a9-%da%a9%d8%a7-%d8%a7%d8%b3%d8%aa%d8%b9%d9%85%d8%a7%d9%84-%da%a9%d8%b1%d8%aa%db%92-%db%81%d9%88%d8%a6%db%92-%d8%b3%db%8c%d9%86%da%88-%d8%a8%d8%a7%da%a9%d8%b3\/"},"modified":"2026-09-12T20:33:55","modified_gmt":"2026-09-12T20:33:55","slug":"%d9%84%db%8c%d9%86%da%88-%d9%84%d8%a7%da%a9-%da%a9%d8%a7-%d8%a7%d8%b3%d8%aa%d8%b9%d9%85%d8%a7%d9%84-%da%a9%d8%b1%d8%aa%db%92-%db%81%d9%88%d8%a6%db%92-%d8%b3%db%8c%d9%86%da%88-%d8%a8%d8%a7%da%a9%d8%b3","status":"publish","type":"post","link":"https:\/\/umang.pk\/ur\/2026\/09\/12\/%d9%84%db%8c%d9%86%da%88-%d9%84%d8%a7%da%a9-%da%a9%d8%a7-%d8%a7%d8%b3%d8%aa%d8%b9%d9%85%d8%a7%d9%84-%da%a9%d8%b1%d8%aa%db%92-%db%81%d9%88%d8%a6%db%92-%d8%b3%db%8c%d9%86%da%88-%d8%a8%d8%a7%da%a9%d8%b3\/","title":{"rendered":"\u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u06a9\u0627 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u0648\u0626\u06d2 \u0633\u06cc\u0646\u0688 \u0628\u0627\u06a9\u0633 \u0644\u06cc\u0646\u06a9\u0633 \u06a9\u06d2 \u0639\u0645\u0644 \u06a9\u0648 \u0631\u0648\u0679 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06a9\u06d2 \u0628\u063a\u06cc\u0631 \u06a9\u06cc\u0633\u06d2 \u06a9\u0631\u06cc\u06ba\u06d4"},"content":{"rendered":"\n<div id=\"\">\n<p>\u06cc\u06c1\u0627\u06ba \u0627\u06cc\u06a9 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06c1\u06d2 \u062c\u0648 \u062e\u0648\u062f \u06a9\u0648 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0628\u0639\u062f \u062f\u0648 \u0641\u0627\u0626\u0644\u0648\u06ba \u06a9\u0648 \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06cc \u06a9\u0648\u0634\u0634 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-text\">without landlock:\n  read \/etc\/hostname            ok\n  read \/tmp\/secret.txt          ok\nwith landlock, \/etc allowed:\n  read \/etc\/hostname            ok\n  read \/tmp\/secret.txt          FAILED (Permission denied)\n<\/code><\/pre>\n<p>\u06a9\u0648\u0626\u06cc \u062c\u0691 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u060c \u06a9\u0648\u0626\u06cc \u06a9\u0646\u0679\u06cc\u0646\u0631 \u0646\u06c1\u06cc\u06ba\u060c \u06a9\u0648\u0626\u06cc \u062a\u0631\u062a\u06cc\u0628 \u0641\u0627\u0626\u0644\u06cc\u06ba\u060c \u0627\u0648\u0631 \u06a9\u0648\u0626\u06cc \u0688\u06cc\u0645\u0646 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0646\u06d2 \u062f\u0627\u0646\u0627 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0641\u0627\u0626\u0644 \u0633\u0633\u0679\u0645 \u062a\u06a9 \u0627\u067e\u0646\u06cc \u0631\u0633\u0627\u0626\u06cc \u062e\u062a\u0645 \u06a9\u0631\u0646\u06d2 \u06a9\u0648 \u06a9\u06c1\u0627\u060c \u0627\u0648\u0631 \u06a9\u0631\u0646\u0644 \u0646\u06d2 \u0627\u0633 \u06a9\u06cc \u062a\u0639\u0645\u06cc\u0644 \u06a9\u06cc\u06d4<\/p>\n<p>\u06cc\u06c1 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u06c1\u06d2\u060c \u062c\u0633\u06d2 2021 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0644\u0648\u06af\u0648\u06ba \u06a9\u06d2 \u0646\u0648\u0679\u0633 \u06a9\u06cc\u06d2 \u0628\u063a\u06cc\u0631 \u06a9\u0631\u0646\u0644 \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0645\u0636\u0645\u0648\u0646 \u0686\u0627\u0631 \u062d\u06cc\u0631\u062a\u0648\u06ba \u06a9\u0648 \u0628\u06cc\u0627\u0646 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062c\u0648 \u0634\u0631\u0648\u0639 \u0633\u06d2 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0628\u0646\u0627\u0646\u06d2 \u0627\u0648\u0631 \u0686\u0644\u0627\u0646\u06d2 \u06a9\u06d2 \u0628\u0639\u062f \u0633\u0628 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0644\u0648\u06af\u0648\u06ba \u067e\u0631 \u062d\u0645\u0644\u06c1 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-table-of-contents\">\u0627\u0646\u0688\u06cc\u06a9\u0633<\/h2>\n<h2 id=\"heading-what-you-need\">\u0622\u067e \u06a9\u0648 \u06a9\u06cc\u0627 \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2<\/h2>\n<p>\u0627\u0633 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0686\u0644\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2\u060c \u0622\u067e \u06a9\u0648 5.13 \u06cc\u0627 \u0627\u0633 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u06a9\u0627 \u062f\u0627\u0646\u0627\u060c \u0645\u0639\u06cc\u0627\u0631\u06cc \u06c1\u06cc\u0688\u0631\u060c \u0627\u0648\u0631 \u0627\u06cc\u06a9 C \u06a9\u0645\u067e\u0627\u0626\u0644\u0631 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u0648\u06af\u06cc\u06d4 \u0627\u0648\u0631 \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba\u060c \u062e\u0627\u0635 \u0637\u0648\u0631 \u067e\u0631 \u062c\u0691 \u0646\u06c1\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\">grep landlock \/sys\/kernel\/security\/lsm\nls \/usr\/include\/linux\/landlock.h\n<\/code><\/pre>\n<p>\u067e\u06c1\u0644\u0627 \u062d\u06a9\u0645 \u0627\u06c1\u0645 \u06c1\u06d2\u06d4 \u06cc\u06c1\u0627\u06ba \u062a\u06a9 \u06a9\u06c1 \u0627\u06af\u0631 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u06a9\u0648 \u062f\u0627\u0646\u0627 \u0645\u06cc\u06ba \u0645\u0631\u062a\u0628 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u060c \u062a\u0628 \u0628\u06be\u06cc \u06cc\u06c1 \u063a\u06cc\u0631 \u0641\u0639\u0627\u0644 \u06c1\u0648 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0633 \u06a9\u06cc \u0648\u062c\u06c1 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0644\u06cc\u0646\u06a9\u0633 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0645\u0627\u0688\u06cc\u0648\u0644 \u06a9\u0627 \u0628\u0648\u0679 \u06a9\u06d2 \u0648\u0642\u062a \u0641\u0639\u0627\u0644 \u06c1\u0648\u0646\u0627 \u0636\u0631\u0648\u0631\u06cc \u06c1\u06d2\u06d4 \u06cc\u06c1 \u06a9\u0645\u067e\u06cc\u0648\u0679\u0631 \u0641\u0627\u0626\u0644 \u067e\u0691\u06be\u062a\u0627 \u06c1\u06d2\u06d4 <code>lockdown,capability,landlock,yama,apparmor<\/code>.<\/p>\n<p>\u0627\u06af\u0631 <code>landlock<\/code> \u06cc\u06c1 \u0622\u067e \u0633\u06d2 \u063a\u0627\u0626\u0628 \u06c1\u06d2\u06d4 \u0628\u0631\u0627\u06c1 \u06a9\u0631\u0645 \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba\u06d4 <code>lsm=landlock,<\/code> \u06a9\u0631\u0646\u0644 \u06a9\u0645\u0627\u0646\u0688 \u0644\u0627\u0626\u0646 \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f\u06c1 \u0641\u06c1\u0631\u0633\u062a \u0645\u06cc\u06ba \u0622\u06af\u06d2 \u0628\u0691\u06be\u06cc\u06ba \u0627\u0648\u0631 \u0631\u06cc\u0628\u0648\u0679 \u06a9\u0631\u06cc\u06ba\u06d4 Ubuntu 22.04 \u0633\u06d2 \u0641\u0639\u0627\u0644 \u0631\u06c1\u0627 \u06c1\u06d2\u060c \u062d\u0627\u0644\u0627\u0646\u06a9\u06c1 \u0645\u0648\u062c\u0648\u062f\u06c1 Fedora \u0627\u0648\u0631 Arch kernels \u0628\u06be\u06cc \u0627\u0633 \u06a9\u06cc \u062d\u0645\u0627\u06cc\u062a \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 <code>grep<\/code> \u0627\u0648\u067e\u0631 \u0648\u0627\u0644\u0627 \u0648\u0627\u062d\u062f \u062c\u0648\u0627\u0628 \u06c1\u06d2 \u062c\u0648 \u0622\u067e \u06a9\u06d2 \u06a9\u0645\u067e\u06cc\u0648\u0679\u0631 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06c1\u0645\u06cc\u062a \u0631\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0630\u06cc\u0644 \u06a9\u06cc \u06c1\u0631 \u0686\u06cc\u0632 \u06a9\u0648 \u0627\u06cc\u06a9 \u0639\u0627\u0645 \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u0686\u0644\u0627\u06cc\u0627 \u06af\u06cc\u0627 \u062a\u06be\u0627 \u0628\u063a\u06cc\u0631 \u0633\u0648\u0688\u0648 \u06a9\u06d2 kernel 5.15.0-190-generic \u067e\u0631 Ubuntu 22.04.5 \u067e\u0631 gcc 11.4 \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0645\u0631\u062a\u0628 \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u062a\u06be\u0627\u06d4<\/p>\n<h2 id=\"heading-where-landlock-sits\">\u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u06a9\u06c1\u0627\u06ba \u0648\u0627\u0642\u0639 \u06c1\u06d2\u061f<\/h2>\n<p>\u0644\u06cc\u0646\u06a9\u0633 \u0633\u06cc\u06a9\u06cc\u0648\u0631\u0679\u06cc \u0645\u0627\u0688\u06cc\u0648\u0644\u0632 \u0641\u0631\u06cc\u0645 \u0648\u0631\u06a9 \u06c1\u06cc\u06ba\u060c \u067e\u0627\u0644\u06cc\u0633\u06cc\u0627\u06ba \u0646\u06c1\u06cc\u06ba\u06d4 \u0641\u0627\u0626\u0644 \u06a9\u0648 \u06a9\u06be\u0648\u0644\u0646\u06d2\u060c \u067e\u0631\u0648\u0633\u06cc\u0633 \u0628\u0646\u0627\u0646\u06d2\u060c \u06cc\u0627 \u0642\u0627\u0628\u0644 \u0639\u0645\u0644 \u0645\u06cc\u0645\u0648\u0631\u06cc \u06a9\u06cc \u0646\u0642\u0634\u06c1 \u0633\u0627\u0632\u06cc \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u062f\u0627\u0646\u0627 \u0627\u06cc\u0644 \u0627\u06cc\u0633 \u0627\u06cc\u0645 \u06c1\u06a9 \u06a9\u0648 \u0641\u06cc\u0635\u0644\u06d2 \u06a9\u06d2 \u0645\u0642\u0627\u0645 \u067e\u0631 \u06a9\u0627\u0644 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u062c\u0648 \u0628\u06be\u06cc \u0645\u0627\u0688\u06cc\u0648\u0644 \u0644\u0648\u0688 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u0627\u0633 \u06a9\u0627 \u062c\u0648\u0627\u0628 \u06c1\u0627\u06ba \u06cc\u0627 \u0646\u06c1\u06cc\u06ba \u0645\u06cc\u06ba \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>SELinux \u0627\u0648\u0631 AppArmor \u062f\u0648 \u0627\u06cc\u0633\u06d2 \u06c1\u06cc\u06ba \u062c\u0646 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0632\u06cc\u0627\u062f\u06c1 \u062a\u0631 \u0644\u0648\u06af\u0648\u06ba \u0646\u06d2 \u0633\u0646\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u062f\u0648\u0646\u0648\u06ba \u0627\u06cc\u0688\u0645\u0646\u0633\u0679\u0631\u06cc\u0679\u0631 \u0679\u0648\u0644\u0632 \u06c1\u06cc\u06ba\u06d4 \u0631\u0648\u0679 \u0648\u0627\u0644\u0627 \u06a9\u0648\u0626\u06cc \u0634\u062e\u0635 \u067e\u0627\u0644\u06cc\u0633\u06cc \u0644\u06a9\u06be\u062a\u0627 \u06c1\u06d2\u060c \u0633\u0633\u0679\u0645 \u0627\u0633\u06d2 \u0644\u0648\u0688 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0627\u0633 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06d2 \u0645\u0637\u0627\u0628\u0642 \u0631\u06c1\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u0627\u0633 \u06a9\u0648 \u0627\u0644\u0679 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u067e\u06c1\u0644\u0627 LSM \u06c1\u06d2 \u062c\u0648 \u0628\u063a\u06cc\u0631 \u0627\u062c\u0627\u0632\u062a \u06a9\u06d2 \u0631\u0646 \u0679\u0627\u0626\u0645 \u06a9\u06d2 \u0648\u0642\u062a \u062e\u0648\u062f \u067e\u0631 \u0644\u0627\u06af\u0648 \u06c1\u0648 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4 \u0622\u067e \u06a9\u0648 \u0627\u067e\u0646\u06d2 \u0645\u0646\u062a\u0638\u0645 \u06a9\u0648 \u0642\u0627\u0626\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u06a9\u06c1 \u0622\u067e \u06a9\u0627 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u067e\u0627\u0644\u06cc\u0633\u06cc \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06c1\u0644 \u06c1\u06d2\u06d4 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0641\u06cc \u0627\u0644\u062d\u0627\u0644 \u0627\u0633 \u0633\u06d2 \u06a9\u0645 \u0645\u0627\u0646\u06af\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u062f\u0627\u0646\u0627 \u0627\u0633\u06d2 \u06a9\u0645 \u06a9\u0631 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>&quot;\u06a9\u0645 \u067e\u0648\u0686\u06be\u06cc\u06ba&#8221; \u0645\u06a9\u0645\u0644 \u0688\u06cc\u0632\u0627\u0626\u0646 \u06c1\u06d2\u06d4 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u0635\u0631\u0641 \u0631\u0633\u0627\u0626\u06cc \u06a9\u0648 \u06c1\u0679\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u06cc\u0633\u06cc \u06a9\u0648\u0626\u06cc \u0686\u06cc\u0632 \u062f\u06cc\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0648\u0626\u06cc \u06a9\u0627\u0644 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u062c\u0648 \u0622\u067e \u06a9\u06d2 \u067e\u0627\u0633 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06cc\u06c1\u06cc \u0648\u062c\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u063a\u06cc\u0631 \u0645\u0631\u0627\u0639\u0627\u062a \u06cc\u0627\u0641\u062a\u06c1 \u0639\u0645\u0644\u0648\u06ba \u06a9\u06cc \u0646\u0645\u0627\u0626\u0634 \u0645\u062d\u0641\u0648\u0638 \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-three-system-calls-and-no-library\">3 \u0633\u0633\u0679\u0645 \u06a9\u0627\u0644\u0632 \u0627\u0648\u0631 \u06a9\u0648\u0626\u06cc \u0644\u0627\u0626\u0628\u0631\u06cc\u0631\u06cc \u0646\u06c1\u06cc\u06ba\u06d4<\/h2>\n<p>\u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u062a\u06cc\u0646 \u0633\u0633\u0679\u0645 \u06a9\u0627\u0644\u0632 \u06c1\u06cc\u06ba \u0627\u0648\u0631 glibc \u0627\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u06a9\u0633\u06cc \u06a9\u0648 \u0628\u06be\u06cc \u0646\u06c1\u06cc\u06ba \u0644\u067e\u06cc\u0679\u062a\u0627 \u06c1\u06d2\u060c \u0644\u06c1\u0630\u0627 \u06c1\u0645 \u0627\u0646\u06c1\u06cc\u06ba \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u0628\u0630\u0631\u06cc\u0639\u06c1 \u06a9\u0627\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba: <code>syscall()<\/code>:<\/p>\n<pre><code class=\"language-c\">static int create_ruleset(const struct landlock_ruleset_attr *attr)\n{ return syscall(__NR_landlock_create_ruleset, attr, sizeof(*attr), 0); }\n\nstatic int add_rule(int fd, const struct landlock_path_beneath_attr *pb)\n{ return syscall(__NR_landlock_add_rule, fd, LANDLOCK_RULE_PATH_BENEATH, pb, 0); }\n\nstatic int restrict_self(int fd)\n{ return syscall(__NR_landlock_restrict_self, fd, 0); }\n<\/code><\/pre>\n<p><code>landlock_create_ruleset<\/code>    \u0627\u0639\u0644\u0627\u0646 \u06a9\u0631\u06cc\u06ba \u06a9\u06c1 \u0642\u0648\u0627\u0639\u062f \u06a9\u06d2 \u0633\u06cc\u0679 \u06a9\u06cc \u0646\u0645\u0627\u0626\u0646\u062f\u06af\u06cc \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u0641\u0627\u0626\u0644 \u0688\u0633\u06a9\u0631\u067e\u0679\u0631 \u06a9\u0648 \u0645\u0646\u0638\u0645 \u06a9\u0631\u0646\u06d2 \u0627\u0648\u0631 \u0648\u0627\u067e\u0633 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u0626\u06d2 \u06a9\u0633 \u0642\u0633\u0645 \u06a9\u06cc \u0631\u0633\u0627\u0626\u06cc \u06c1\u06d2\u06d4 <code>landlock_add_rule<\/code> \u0688\u0627\u0626\u0631\u06a9\u0679\u0631\u06cc \u06a9\u06cc \u0634\u06a9\u0644 \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u0627\u0633\u062a\u062b\u0646\u0627\u0621 \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba \u062c\u0633\u06d2 \u0622\u067e \u0631\u06a9\u06be\u0646\u0627 \u0686\u0627\u06c1\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0622\u062e\u0631 \u06a9\u0627\u0631 <code>landlock_restrict_self<\/code> \u06a9\u0627\u0644\u0646\u06af \u06a9\u06d2 \u0639\u0645\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06c1\u0631 \u0686\u06cc\u0632 \u06a9\u0648 \u0645\u0633\u062a\u0642\u0644 \u0628\u0646\u0627 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06a9\u06c1 <code>handled_access_fs<\/code> \u0631\u0648\u0644\u0633\u06cc\u0679 \u067e\u0631\u0627\u067e\u0631\u0679\u06cc\u0632 \u0645\u06cc\u06ba \u0641\u06cc\u0644\u0688\u0632 \u0648\u06c1 \u06c1\u06cc\u06ba \u062c\u06c1\u0627\u06ba \u0644\u0648\u06af \u0627\u0633\u06d2 \u067e\u06cc\u0686\u06be\u06d2 \u06a9\u06cc \u0637\u0631\u0641 \u062d\u0627\u0635\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u06a9\u06cc\u0627 \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u0627 \u06c1\u06d2 \u062f\u0631\u062c \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0641\u06c1\u0631\u0633\u062a \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0631\u0633\u0627\u0626\u06cc \u06a9\u06cc \u0648\u06c1 \u0627\u0642\u0633\u0627\u0645 \u062c\u0646 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06cc\u06c1 \u0627\u0635\u0648\u0644 \u0633\u06cc\u0679 \u0630\u0645\u06c1 \u062f\u0627\u0631 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0627\u0633 \u0641\u06c1\u0631\u0633\u062a \u0645\u06cc\u06ba \u0645\u0648\u062c\u0648\u062f \u06a9\u0633\u06cc \u0628\u06be\u06cc \u0686\u06cc\u0632 \u06a9\u0648 \u06a9\u06c1\u06cc\u06ba \u0628\u06be\u06cc \u0645\u0633\u062a\u0631\u062f \u06a9\u0631 \u062f\u06cc\u0627 \u062c\u0627\u0626\u06d2 \u06af\u0627 \u0633\u0648\u0627\u0626\u06d2 \u0627\u0646 \u0631\u0627\u0633\u062a\u0648\u06ba \u06a9\u06d2 \u062c\u0646\u06c1\u06cc\u06ba \u0622\u067e \u0648\u0627\u0636\u062d \u0637\u0648\u0631 \u067e\u0631 \u0634\u0627\u0645\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0627\u06af\u0631 \u0622\u067e \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06cc \u0631\u0633\u0627\u0626\u06cc \u06a9\u0648 \u06c1\u06cc\u0646\u0688\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u0622\u067e \u067e\u0648\u0631\u06d2 \u0641\u0627\u0626\u0644 \u0633\u0633\u0679\u0645 \u062a\u06a9 \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06cc \u0631\u0633\u0627\u0626\u06cc \u0633\u06d2 \u0645\u062d\u0631\u0648\u0645 \u06c1\u0648\u062c\u0627\u0626\u06cc\u06ba \u06af\u06d2 \u062c\u0628 \u062a\u06a9 \u06a9\u06c1 \u0622\u067e \u062f\u0648\u0628\u0627\u0631\u06c1 \u0627\u0635\u0648\u0644 \u0634\u0627\u0645\u0644 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-a-program-that-restricts-itself\">\u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u062c\u0648 \u0622\u067e \u06a9\u0648 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/h2>\n<p>\u06cc\u06c1\u0627\u06ba \u067e\u0648\u0631\u06cc \u06a9\u06c1\u0627\u0646\u06cc \u06c1\u06d2:<\/p>\n<pre><code class=\"language-c\">#define _GNU_SOURCE\n#include <linux>\n#include <sys>\n#include <sys>\n#include <fcntl.h>\n#include <unistd.h>\n#include <stdio.h>\n#include <string.h>\n#include <errno.h>\n\n#define READ_RIGHTS (LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR)\n\nstatic int create_ruleset(const struct landlock_ruleset_attr *attr)\n{ return syscall(__NR_landlock_create_ruleset, attr, sizeof(*attr), 0); }\n\nstatic int add_rule(int fd, const struct landlock_path_beneath_attr *pb)\n{ return syscall(__NR_landlock_add_rule, fd, LANDLOCK_RULE_PATH_BENEATH, pb, 0); }\n\nstatic int restrict_self(int fd)\n{ return syscall(__NR_landlock_restrict_self, fd, 0); }\n\nstatic int allow_read(int ruleset_fd, const char *path)\n{\n    struct landlock_path_beneath_attr pb = { .allowed_access = READ_RIGHTS };\n    int rc;\n\n    pb.parent_fd = open(path, O_PATH | O_CLOEXEC);\n    if (pb.parent_fd < 0) { perror(path); return -1; }\n    rc = add_rule(ruleset_fd, &#038;pb);\n    close(pb.parent_fd);\n    return rc;\n}\n\nstatic void try_read(const char *path)\n{\n    int fd = open(path, O_RDONLY);\n\n    if (fd < 0)\n        printf(\"  read %-24s FAILED (%s)n\", path, strerror(errno));\n    else\n        { printf(\"  read %-24s okn\", path); close(fd); }\n}\n\nint main(void)\n{\n    struct landlock_ruleset_attr attr = { .handled_access_fs = READ_RIGHTS };\n    int ruleset_fd = create_ruleset(&#038;attr);\n\n    if (ruleset_fd < 0) { perror(\"landlock_create_ruleset\"); return 1; }\n    if (allow_read(ruleset_fd, \"\/etc\") < 0) return 1;\n\n    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror(\"prctl\"); return 1; }\n    if (restrict_self(ruleset_fd)) { perror(\"landlock_restrict_self\"); return 1; }\n    close(ruleset_fd);\n\n    printf(\"with landlock, \/etc allowed:n\");\n    try_read(\"\/etc\/hostname\");\n    try_read(\"\/tmp\/secret.txt\");\n    return 0;\n}\n<\/errno.h><\/string.h><\/stdio.h><\/unistd.h><\/fcntl.h><\/sys><\/sys><\/linux><\/code><\/pre>\n<p>\u0628\u0646\u0627\u0626\u06cc\u06ba \u0627\u0648\u0631 \u0686\u0644\u0627\u0626\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\">gcc -Wall -o sandbox sandbox.c\necho \"hunter2\" > \/tmp\/secret.txt\n.\/sandbox\n<\/code><\/pre>\n<pre><code class=\"language-text\">with landlock, \/etc allowed:\n  read \/etc\/hostname            ok\n  read \/tmp\/secret.txt          FAILED (Permission denied)\n<\/code><\/pre>\n<p>\u062f\u0648 \u062a\u0641\u0635\u06cc\u0644\u0627\u062a \u0627\u06c1\u0645 \u06c1\u06cc\u06ba\u06d4 \u0642\u0648\u0627\u0639\u062f \u067e\u0627\u062a\u06be \u0633\u0679\u0631\u0646\u06af\u0632 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u0627\u0648\u067e\u0646 \u0641\u0627\u0626\u0644 \u0688\u0633\u06a9\u0631\u067e\u0679\u0631\u0632 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0688\u0627\u0626\u0631\u06cc\u06a9\u0679\u0631\u06cc\u0632 \u06a9\u0627 \u062d\u0648\u0627\u0644\u06c1 \u062f\u06cc\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 <code>O_PATH<\/code> \u0644\u06c1\u0630\u0627 \u0622\u067e \u0627\u06cc\u06a9 \u06c1\u06cc\u0646\u0688\u0644 \u062d\u0627\u0635\u0644 \u06a9\u0631\u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u06cc\u06c1\u0627\u06ba \u062a\u06a9 \u06a9\u06c1 \u0627\u06af\u0631 \u0622\u067e \u06a9\u06d2 \u067e\u0627\u0633 \u0688\u0627\u0626\u0631\u06a9\u0679\u0631\u06cc \u0645\u06cc\u06ba \u06c1\u06cc \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u0627\u0648\u0631 <code>restrict_self<\/code> \u06cc\u06c1 \u06a9\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0639\u0645\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0641\u0648\u0631\u06cc \u0637\u0648\u0631 \u067e\u0631 \u0646\u0627\u0641\u0630 \u06c1\u0648\u062a\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u0633\u06d2 \u06a9\u0627\u0644\u0639\u062f\u0645 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627\u06d4<\/p>\n<h2 id=\"heading-why-nonewprivs-is-mandatory\">\u06a9\u06cc\u0648\u06ba <code>no_new_privs<\/code> \u062f\u0631\u06a9\u0627\u0631 \u06c1\u06d2\u06d4<\/h2>\n<p>\u0644\u06d2 \u0644\u0648\u06d4 <code>prctl<\/code> \u06a9\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u067e\u0631 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u0627\u0645 \u06a9\u0631\u0646\u0627 \u0628\u0646\u062f \u06a9\u0631 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-text\">landlock_restrict_self -> Operation not permitted\n<\/code><\/pre>\n<p>\u06a9\u06c1 <code>EPERM<\/code>\u0627\u0648\u0631 \u06cc\u06c1 \u062c\u0627\u0646 \u0628\u0648\u062c\u06be \u06a9\u0631 \u06c1\u06d2\u06d4 <code>PR_SET_NO_NEW_PRIVS<\/code> \u062f\u0627\u0646\u0627 \u06a9\u0648 \u0628\u062a\u0627\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u06cc\u06c1 \u0639\u0645\u0644 \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06cc \u0627\u0648\u0644\u0627\u062f \u06a9\u0628\u06be\u06cc \u0628\u06be\u06cc \u0627\u0633 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0645\u0631\u0627\u0639\u0627\u062a \u062d\u0627\u0635\u0644 \u0646\u06c1\u06cc\u06ba \u06a9\u0631 \u0633\u06a9\u062a\u06cc: <code>execve<\/code>\u06cc\u06c1 \u0633\u06cc\u0679\u0648\u0626\u0688 \u0628\u0627\u0626\u0646\u0631\u06cc\u0632 \u0686\u0644\u0627 \u06a9\u0631 \u0633\u06cc\u0646\u0688 \u0628\u0627\u06a9\u0633 \u06a9\u06d2 \u0639\u0645\u0644 \u06a9\u0648 \u0641\u0631\u0627\u0631 \u06c1\u0648\u0646\u06d2 \u0633\u06d2 \u0631\u0648\u06a9\u0646\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0627\u0633 \u0636\u0645\u0627\u0646\u062a \u06a9\u06d2 \u0628\u063a\u06cc\u0631\u060c \u0645\u062d\u062f\u0648\u062f \u0639\u0645\u0644 \u0686\u0644 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 <code>sudo<\/code> \u0645\u062a\u0628\u0627\u062f\u0644 \u0637\u0648\u0631 \u067e\u0631\u060c \u06c1\u0645 \u0646\u06d2 \u0627\u0628\u06be\u06cc \u062c\u0648 \u067e\u0627\u0628\u0646\u062f\u06cc\u0627\u06ba \u0644\u06af\u0627\u0626\u06cc \u06c1\u06cc\u06ba \u0627\u0646 \u0633\u06d2 \u0622\u0632\u0627\u062f \u06c1\u0648\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u0633\u06cc\u0679\u0648\u0626\u0688 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u06a9\u0631\u06cc\u06ba\u06d4 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u062e\u0648\u062f \u06a9\u0648 \u0644\u0627\u06af\u0648 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u0627\u0646\u06a9\u0627\u0631 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0628\u062c\u0627\u0626\u06d2 \u0627\u0633 \u0645\u06cc\u06ba \u0633\u0648\u0631\u0627\u062e \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0627\u06cc\u06a9 \u0633\u06cc\u0646\u0688 \u0628\u0627\u06a9\u0633 \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0633\u06cc\u0679 <code>no_new_privs<\/code> \u0633\u0628 \u0633\u06d2 \u067e\u06c1\u0644\u06d2\u060c \u06c1\u0631 \u0628\u0627\u0631.<\/p>\n<h2 id=\"heading-rulesets-intersect-they-never-widen\">\u0627\u0635\u0648\u0644 \u0627\u06cc\u06a9 \u062f\u0648\u0633\u0631\u06d2 \u06a9\u0648 \u0622\u067e\u0633 \u0645\u06cc\u06ba \u062c\u0648\u0691\u062a\u06d2 \u06c1\u06cc\u06ba \u0644\u06cc\u06a9\u0646 \u06a9\u0628\u06be\u06cc \u062a\u0648\u0633\u06cc\u0639 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u06d2<\/h2>\n<p>\u06cc\u06c1 \u0648\u06c1 \u067e\u0631\u0627\u067e\u0631\u0679\u06cc\u0632 \u06c1\u06cc\u06ba \u062c\u0648 \u0622\u067e \u06a9\u0648 \u0645\u0644\u062a\u06cc \u06c1\u06cc\u06ba\u06d4 \u0627\u06cc\u06a9 \u0627\u0635\u0648\u0644 \u0633\u06cc\u0679 \u0644\u0627\u06af\u0648 \u06a9\u0631\u06cc\u06ba \u062c\u0648 \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u062a\u0627 \u06c1\u06d2: <code>\/etc<\/code>\u067e\u06be\u0631 \u062f\u0648\u0633\u0631\u0627 \u0627\u0644\u0627\u0624\u0646\u0633 \u0644\u06af\u0627\u0626\u06cc\u06ba\u06d4 <code>\/tmp<\/code>\u0627\u0633 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u067e\u0648\u0686\u06be\u06cc\u06ba \u06a9\u06c1 \u0622\u067e \u06a9\u0633 \u062a\u06a9 \u067e\u06c1\u0646\u0686 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-text\">after first ruleset:  \/etc=ok               \/tmp=Permission denied\nafter second ruleset: \/etc=Permission denied  \/tmp=Permission denied\n<\/code><\/pre>\n<p>\u062f\u0648\u0633\u0631\u0627 \u0627\u0635\u0648\u0644 \u0633\u06cc\u0679 \u0634\u0627\u0645\u0644 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u06af\u06cc\u0627 \u06c1\u06d2\u06d4 <code>\/tmp<\/code>. \u0627\u0633\u06d2 \u0644\u06d2 \u06af\u06cc\u0627 <code>\/etc<\/code>\u0627\u0648\u0631 \u062a\u0645\u06c1\u0627\u0631\u06d2 \u0644\u06cc\u06d2 \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba \u0628\u0686\u0627\u06d4<\/p>\n<p>\u06c1\u0631 \u0627\u06cc\u06a9 <code>restrict_self<\/code> \u06cc\u06c1 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u0644\u0627\u06af\u0648 \u06c1\u0648\u0646\u06d2 \u0648\u0627\u0644\u06cc \u06c1\u0631 \u0686\u06cc\u0632 \u06a9\u0648 \u062c\u0648\u0691\u062a\u0627 \u06c1\u06d2\u06d4 \u0642\u0648\u0627\u0646\u06cc\u0646 \u06a9\u06d2 \u067e\u06c1\u0644\u06d2 \u0633\u06cc\u0679 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u06c1\u06d2\u06d4 <code>\/etc<\/code> \u0627\u0648\u0631 \u0628\u0627\u0642\u06cc \u0627\u0646\u06a9\u0627\u0631\u06cc \u062a\u06be\u06d2\u06d4 \u062f\u0648\u0633\u0631\u06cc \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u06c1\u06d2 <code>\/tmp<\/code> \u0627\u0648\u0631 \u0628\u0627\u0642\u06cc\u0648\u06ba \u0646\u06d2 \u0627\u0646\u06a9\u0627\u0631 \u06a9\u06cc\u0627\u06d4 \u062c\u0648 \u0628\u0686\u062a\u0627 \u06c1\u06d2 \u0648\u06c1 \u0627\u0646 \u062f\u0648\u0646\u0648\u06ba \u06a9\u0627 \u0645\u0644\u0627\u067e \u06c1\u06d2\u060c \u06cc\u0639\u0646\u06cc \u062e\u0627\u0644\u06cc \u067e\u0646\u06d4<\/p>\n<p>\u0644\u06c1\u0630\u0627 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u0633\u06cc\u0646\u0688 \u0628\u0627\u06a9\u0633 \u0634\u0627\u0641\u0679 \u06c1\u06d2\u06d4 \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0627\u06cc\u067e\u0644\u06cc\u06a9\u06cc\u0634\u0646 \u0635\u0631\u0641 \u0633\u062e\u062a \u06a9\u0631 \u0633\u06a9\u062a\u06cc \u06c1\u06d2\u060c \u0688\u06be\u06cc\u0644\u06cc \u0646\u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u06a9\u06c1\u06cc\u06ba \u0628\u06be\u06cc \u06a9\u0648\u0626\u06cc API \u0622\u067e\u0631\u06cc\u0634\u0646\u0632 \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba \u062c\u0648 \u0627\u06cc\u06a9 \u0645\u062d\u062f\u0648\u062f \u0639\u0645\u0644 \u06a9\u0631 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u06af\u0631 \u06a9\u0633\u06cc \u0639\u0645\u0644 \u06a9\u06d2 \u0644\u06cc\u06d2 \u062f\u0648 \u0688\u0627\u0626\u0631\u06cc\u06a9\u0679\u0631\u06cc\u0648\u06ba \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u062f\u0631\u06a9\u0627\u0631 \u06c1\u0648\u062a\u06cc \u06c1\u06d2\u060c \u062a\u0648 \u062f\u0648\u0646\u0648\u06ba \u0627\u0635\u0648\u0644\u0648\u06ba \u06a9\u0648 \u0644\u0627\u06af\u0648 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0627\u06cc\u06a9 \u0627\u0635\u0648\u0644 \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0627\u0633 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06cc\u06c1 \u0628\u06be\u06cc \u06c1\u06d2 \u06a9\u06c1 \u0622\u067e \u0627\u067e\u0646\u0627 \u062e\u06cc\u0627\u0644 \u0646\u06c1\u06cc\u06ba \u0628\u062f\u0644 \u0633\u06a9\u062a\u06d2\u06d4 \u0627\u06cc\u06a9 \u0637\u0648\u06cc\u0644 \u0639\u0631\u0635\u06d2 \u0633\u06d2 \u0686\u0644\u0646\u06d2 \u0648\u0627\u0644\u0627 \u0639\u0645\u0644 \u062c\u0648 \u0634\u0631\u0648\u0639 \u0645\u06cc\u06ba \u062e\u0648\u062f \u0645\u062d\u062f\u0648\u062f \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u060c \u0628\u0639\u062f \u0645\u06cc\u06ba \u06cc\u0627 \u062a\u0648 \u062e\u0648\u062f \u06cc\u0627 \u062f\u0648\u0633\u0631\u0648\u06ba \u06a9\u06cc \u0637\u0631\u0641 \u0633\u06d2 \u0646\u06c1\u06cc\u06ba \u062f\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627\u060c \u062c\u0628 \u062a\u06a9 \u06a9\u06c1 \u06a9\u0648\u0626\u06cc \u0646\u06cc\u0627 \u0639\u0645\u0644 \u0634\u0631\u0648\u0639 \u0646\u06c1 \u06a9\u06cc\u0627 \u062c\u0627\u0626\u06d2\u06d4<\/p>\n<h2 id=\"heading-what-your-children-inherit\">\u062c\u0648 \u0622\u067e \u06a9\u06d2 \u0628\u0686\u0648\u06ba \u06a9\u0648 \u0648\u0631\u0627\u062b\u062a \u0645\u06cc\u06ba \u0645\u0644\u062a\u0627 \u06c1\u06d2\u06d4<\/h2>\n<p>\u062d\u062f\u0648\u062f \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06c1\u06cc\u06ba: <code>fork<\/code> \u0628\u063a\u06cc\u0631 \u067e\u0648\u0686\u06be\u06d2:<\/p>\n<pre><code class=\"language-text\">parent:       \/etc=ok   \/tmp\/secret.txt=Permission denied\nforked child: \/etc=ok   \/tmp\/secret.txt=Permission denied\n<\/code><\/pre>\n<p>\u0628\u0686\u06d2 \u0628\u0627\u0644\u06a9\u0644 \u0627\u067e\u0646\u06d2 \u0648\u0627\u0644\u062f\u06cc\u0646 \u06a9\u06d2 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u0688\u0648\u0645\u06cc\u0646 \u06a9\u06d2 \u0648\u0627\u0631\u062b \u06c1\u0648\u06ba \u06af\u06d2 \u0627\u0648\u0631 \u0627\u0633\u06d2 \u063a\u06cc\u0631 \u0686\u06cc\u06a9 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0648\u0626\u06cc \u062c\u06be\u0646\u0688\u0627 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u06af\u0627\u06d4 \u0627\u06cc\u06a9 \u06c1\u06cc \u0628\u0627\u062a \u067e\u0631 \u0644\u0627\u06af\u0648 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 <code>execve<\/code>\u06cc\u06c1 \u0646\u0642\u0637\u06c1 \u06c1\u06d2 <code>no_new_privs<\/code>: \u0646\u06cc\u0627 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u067e\u06c1\u0644\u06d2 \u0633\u06d2 \u06c1\u06cc \u067e\u0686\u06be\u0644\u06d2 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u06d2 \u0642\u0627\u0626\u0645 \u06a9\u0631\u062f\u06c1 \u0633\u06cc\u0646\u0688 \u0628\u0627\u06a9\u0633 \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0634\u0631\u0648\u0639 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u06cc\u06c1 \u0648\u06c1 \u0686\u06cc\u0632 \u06c1\u06d2 \u062c\u0648 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u06a9\u0648 \u063a\u06cc\u0631 \u062a\u062d\u0631\u06cc\u0631\u06cc \u0645\u0648\u0627\u062f \u06a9\u06cc \u067e\u06cc\u06a9\u0646\u06af \u06a9\u06d2 \u0644\u06cc\u06d2 \u0645\u0641\u06cc\u062f \u0628\u0646\u0627\u062a\u06cc \u06c1\u06d2\u06d4 \u0627\u06af\u0631 \u0622\u067e \u0627\u067e\u0646\u06d2 \u0622\u067e \u06a9\u0648 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u067e\u06be\u0631 \u0627\u0633 \u067e\u0631 \u0639\u0645\u0644 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0633 \u06a9\u0648 \u0622\u067e \u0634\u0627\u0645\u0644 \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u062a\u0648 \u0622\u067e \u06cc\u06c1 \u062c\u0627\u0646\u06d2 \u0628\u063a\u06cc\u0631 \u06a9\u06c1 \u062d\u062f\u0648\u062f \u0645\u0648\u062c\u0648\u062f \u06c1\u06cc\u06ba \u062d\u062f\u0648\u062f \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0686\u0644\u06cc\u06ba \u06af\u06d2\u06d4<\/p>\n<h2 id=\"heading-the-exec-trap\">\u06a9\u06c1 <code>exec<\/code> \u062c\u0627\u0644<\/h2>\n<p>\u06c1\u0645 \u0646\u06d2 \u0628\u06be\u06cc \u062c\u0627\u0644 \u0628\u0686\u06be\u0627\u0626\u06d2\u06d4 \u0627\u0648\u067e\u0631 \u0648\u0627\u0644\u06d2 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u0648 \u0644\u06d2 \u0644\u06cc\u06ba\u06d4 <code>\/etc<\/code> \u0627\u0633\u06d2 \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u06ba \u0627\u0648\u0631 \u06a9\u0686\u06be \u0628\u06be\u06cc \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u06a9\u0648\u0634\u0634 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-text\">allowed: \/etc\nexecl(\/usr\/bin\/cat) failed: Permission denied\n<\/code><\/pre>\n<p>\u0628\u0627\u0626\u0646\u0631\u06cc \u0686\u0644\u0627\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0622\u067e \u06a9\u0648 \u0627\u0633\u06d2 \u067e\u0691\u06be\u0646\u0627 \u06c1\u0648\u06af\u0627\u06d4 \u06cc\u06c1 \u0627\u0635\u0648\u0644 \u0633\u06cc\u0679 \u062f\u0631\u062c \u0630\u06cc\u0644 \u06a9\u0648 \u0633\u0646\u0628\u06be\u0627\u0644\u062a\u0627 \u06c1\u06d2: <code>LANDLOCK_ACCESS_FS_READ_FILE<\/code>\u062a\u0648 \u062f\u0627\u0646\u0627 \u0686\u06cc\u06a9 \u06a9\u0631\u062a\u0627 \u06c1\u06d2: <code>\/usr\/bin\/cat<\/code> \u0622\u067e \u0627\u0633\u06d2 \u067e\u0691\u06be \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0644\u06cc\u06a9\u0646 \u0627\u0633 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u06a9\u0648\u0626\u06cc \u0627\u0635\u0648\u0644 \u0646\u06c1\u06cc\u06ba \u06c1\u06cc\u06ba\u06d4 <code>\/usr<\/code>\u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0634\u0631\u0648\u0639 \u06c1\u0648\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0645\u0633\u062a\u0631\u062f \u06a9\u0631 \u062f\u06cc\u06ba\u06d4<\/p>\n<p>\u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba <code>\/usr<\/code> \u0627\u06af\u0631 \u0622\u067e \u0627\u0633\u06d2 \u0627\u0633\u06cc \u0627\u0635\u0648\u0644 \u067e\u0631 \u0644\u0627\u06af\u0648 \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062a\u0648 \u06cc\u06c1 \u06a9\u0627\u0645 \u06a9\u0631\u06d2 \u06af\u0627\u06d4<\/p>\n<pre><code class=\"language-text\">allowed: \/etc and \/usr\ndevils-dell\n<\/code><\/pre>\n<p>\u0639\u0627\u0645 \u0633\u0628\u0642 \u06cc\u06c1 \u06c1\u06d2 \u06a9\u06c1 \u0622\u067e \u06a9\u06d2 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u0633\u06cc\u0646\u0688 \u0628\u0627\u06a9\u0633 \u0645\u06cc\u06ba \u0622\u067e \u06a9\u06d2 \u0639\u0645\u0644 \u0633\u06d2 \u0645\u062a\u0639\u0644\u0642\u06c1 \u06c1\u0631 \u0686\u06cc\u0632 \u067e\u0631 \u0645\u0634\u062a\u0645\u0644 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u060c \u0627\u0648\u0631 \u0648\u06c1 \u0633\u06cc\u0679 \u0622\u067e \u06a9\u06d2 \u062e\u06cc\u0627\u0644 \u0633\u06d2 \u0628\u0691\u0627 \u06c1\u06d2\u06d4 \u0628\u0627\u0626\u0646\u0631\u06cc\u060c \u0627\u0633 \u06a9\u0627 \u0645\u062a\u0631\u062c\u0645\u060c \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u0645\u0634\u062a\u0631\u06a9\u06c1 \u0644\u0627\u0626\u0628\u0631\u06cc\u0631\u06cc\u0627\u06ba \u062c\u0648 \u0644\u0648\u0688 \u06a9\u06cc \u06af\u0626\u06cc \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u06a9\u0648\u0626\u06cc \u0628\u06be\u06cc \u062a\u0631\u062a\u06cc\u0628 \u062c\u0648 \u0634\u0631\u0648\u0639 \u0645\u06cc\u06ba \u067e\u0691\u06be\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06d2\u06d4 <code>ldd<\/code> \u0628\u0627\u0626\u0646\u0631\u06cc\u0632 \u0641\u06c1\u0631\u0633\u062a\u0648\u06ba \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0634\u0631\u0648\u0639 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u0627\u0686\u06be\u06cc \u062c\u06af\u06c1 \u06c1\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-wrapping-a-program-you-didnt-write\">\u0627\u06cc\u0633\u0627 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0644\u067e\u06cc\u0679\u0646\u0627 \u062c\u0648 \u0622\u067e \u0646\u06d2 \u0646\u06c1\u06cc\u06ba \u0644\u06a9\u06be\u0627<\/h2>\n<p>\u062c\u0627\u0646\u0634\u06cc\u0646\u06cc <code>exec<\/code> \u06cc\u06c1 \u0648\u06c1\u06cc \u06c1\u06d2 \u062c\u0648 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u06a9\u0648 \u0622\u067e \u06a9\u06d2 \u0627\u067e\u0646\u06d2 \u06a9\u0648\u0688 \u0633\u06d2 \u0622\u06af\u06d2 \u0645\u0641\u06cc\u062f \u0628\u0646\u0627\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u06af\u0631 \u0622\u067e \u062e\u0648\u062f \u06a9\u0648 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u067e\u06be\u0631 \u062c\u0648 \u06a9\u0686\u06be \u0628\u06be\u06cc \u0622\u067e \u0634\u0627\u0645\u0644 \u06a9\u0631\u0646\u0627 \u0686\u0627\u06c1\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0633\u06d2 \u0686\u0644\u0627\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u06cc\u06c1 \u0622\u067e \u06a9\u06d2 \u062a\u0639\u0627\u0648\u0646 \u06cc\u0627 \u062c\u0627\u0646\u06d2 \u0628\u063a\u06cc\u0631 \u0633\u06cc\u0646\u0688 \u0628\u0627\u06a9\u0633 \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0686\u0644\u06d2 \u06af\u0627\u06d4<\/p>\n<p>\u062f\u0633\u062a\u06cc\u0627\u0628 \u0631\u06cc\u067e\u0631\u0632 \u06a9\u0648 \u0645\u0646\u062f\u0631\u062c\u06c1 \u0628\u0627\u0644\u0627 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0645\u06cc\u06ba \u0634\u0627\u0645\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4 \u06c1\u06cc\u0646\u0688\u0644 <code>LANDLOCK_ACCESS_FS_EXECUTE<\/code> \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u06a9\u06d2 \u0633\u0627\u062a\u06be \u0633\u0633\u0679\u0645 \u0688\u0627\u0626\u0631\u06a9\u0679\u0631\u06cc \u0645\u06cc\u06ba \u062f\u0631\u06a9\u0627\u0631 \u0628\u0627\u0626\u0646\u0631\u06cc\u0632 \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u06ba\u060c \u067e\u06be\u0631 \u0635\u0627\u0631\u0641 \u06a9\u06cc \u0637\u0631\u0641 \u0633\u06d2 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631\u062f\u06c1 \u0648\u0631\u06a9\u0646\u06af \u0688\u0627\u0626\u0631\u06a9\u0679\u0631\u06cc \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-c\">#define RIGHTS (LANDLOCK_ACCESS_FS_READ_FILE | LANDLOCK_ACCESS_FS_READ_DIR | \n                LANDLOCK_ACCESS_FS_EXECUTE)\n\nstatic int add_path(int ruleset_fd, const char *path)\n{\n    struct landlock_path_beneath_attr pb = { .allowed_access = RIGHTS };\n    int rc;\n\n    pb.parent_fd = open(path, O_PATH | O_CLOEXEC);\n    if (pb.parent_fd < 0)\n        return -1;\n    rc = syscall(__NR_landlock_add_rule, ruleset_fd,\n                 LANDLOCK_RULE_PATH_BENEATH, &#038;pb, 0);\n    close(pb.parent_fd);\n    return rc;\n}\n\nint main(int argc, char **argv)\n{\n    struct landlock_ruleset_attr attr = { .handled_access_fs = RIGHTS };\n    const char *base[] = { \"\/usr\", \"\/lib\", \"\/lib64\", \"\/bin\", \"\/etc\" };\n    int fd, i;\n\n    if (argc < 3) { fprintf(stderr, \"usage: %s DIR CMD...n\", argv[0]); return 2; }\n\n    fd = syscall(__NR_landlock_create_ruleset, &#038;attr, sizeof(attr), 0);\n    if (fd < 0) { perror(\"create_ruleset\"); return 1; }\n\n    for (i = 0; i < (int)(sizeof(base) \/ sizeof(*base)); i++)\n        add_path(fd, base[i]);\n    if (add_path(fd, argv[1]) < 0) { perror(argv[1]); return 1; }\n\n    if (prctl(PR_SET_NO_NEW_PRIVS, 1, 0, 0, 0)) { perror(\"prctl\"); return 1; }\n    if (syscall(__NR_landlock_restrict_self, fd, 0)) { perror(\"restrict_self\"); return 1; }\n    close(fd);\n\n    execvp(argv[2], &#038;argv[2]);\n    fprintf(stderr, \"%s: %sn\", argv[2], strerror(errno));\n    return 1;\n}\n<\/code><\/pre>\n<p>\u0644\u0648\u067e \u06a9\u06cc\u0627 \u0646\u0638\u0631 \u0627\u0646\u062f\u0627\u0632 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 <code>add_path<\/code> \u0648\u0627\u067e\u0633 \u0622\u062a\u0627 \u06c1\u06d2\u060c \u062a\u0648 \u0648\u06c1\u06cc \u0628\u0627\u0626\u0646\u0631\u06cc \u0622\u067e \u06a9\u06d2 \u0633\u0633\u0679\u0645 \u067e\u0631 \u06a9\u0627\u0645 \u06a9\u0631\u06d2 \u06af\u06cc\u06d4 <code>\/lib64<\/code> \u06cc\u0627 <code>\/bin<\/code> \u06cc\u06c1 \u06cc\u0627 \u062a\u0648 \u0645\u0648\u062c\u0648\u062f \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u06cc\u0627 \u0639\u0644\u0627\u0645\u062a\u06cc \u0637\u0648\u0631 \u067e\u0631 \u06a9\u06c1\u06cc\u06ba \u0627\u0648\u0631 \u062c\u0691\u0627 \u06c1\u0648\u0627 \u06c1\u06d2\u06d4 \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0646\u0627\u0645 \u06a9\u06cc \u0688\u0627\u0626\u0631\u06a9\u0679\u0631\u06cc \u06a9\u06cc \u062c\u0627\u0646\u0686 \u067e\u0691\u062a\u0627\u0644 \u06a9\u06cc \u06af\u0626\u06cc \u06c1\u06d2 \u06a9\u06cc\u0648\u0646\u06a9\u06c1 \u0628\u0639\u062f \u0645\u06cc\u06ba \u0627\u06cc\u06a9 \u0627\u0644\u062c\u06be\u0646 \u0632\u062f\u06c1 \u0645\u0633\u062a\u0631\u062f \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u0627\u0628 \u0627\u06cc\u06a9 \u062e\u0631\u0627\u0628\u06cc \u0648\u0627\u0642\u0639 \u06c1\u0648\u0646\u06cc \u0686\u0627\u06c1\u0626\u06d2\u06d4<\/p>\n<p>\u0627\u0628 <code>cat<\/code> \u0627\u0648\u0631 <code>ls<\/code> \u0622\u067e \u0635\u0631\u0641 \u0648\u0631\u06a9\u0646\u06af \u0688\u0627\u0626\u0631\u06a9\u0679\u0631\u06cc \u062f\u06cc\u06a9\u06be \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba \u0627\u0648\u0631 \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\">mkdir -p \/tmp\/work && echo \"project data\" > \/tmp\/work\/notes.txt\n\n.\/llrun \/tmp\/work cat \/tmp\/work\/notes.txt\n.\/llrun \/tmp\/work cat \/tmp\/secret.txt\n.\/llrun \/tmp\/work ls \/home\n<\/code><\/pre>\n<pre><code class=\"language-text\">project data\ncat: \/tmp\/secret.txt: Permission denied\nls: cannot open directory '\/home': Permission denied\n<\/code><\/pre>\n<p>\u0646\u06c1 \u06c1\u06cc \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0645\u06cc\u06ba \u062a\u0631\u0645\u06cc\u0645 \u06a9\u06cc \u06af\u0626\u06cc \u062a\u06be\u06cc\u060c \u0646\u06c1 \u062f\u0648\u0628\u0627\u0631\u06c1 \u0645\u0631\u062a\u0628 \u06a9\u06cc \u06af\u0626\u06cc \u062a\u06be\u06cc\u060c \u0646\u06c1 \u06c1\u06cc \u0631\u0636\u0627\u0645\u0646\u062f\u06cc \u06a9\u06cc \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u06cc \u06af\u0626\u06cc \u062a\u06be\u06cc\u06d4 <code>bwrap<\/code> \u0627\u0633\u06cc \u0637\u0631\u062d \u06a9\u06d2 \u0679\u0648\u0644\u0632 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u06d2 \u0627\u0631\u062f \u06af\u0631\u062f \u0645\u0627\u0624\u0646\u0679\u0633 \u0627\u0648\u0631 \u0635\u0627\u0631\u0641 \u06a9\u06d2 \u0646\u0627\u0645 \u06a9\u06cc \u062c\u06af\u06c1\u06cc\u06ba \u0628\u0646\u0627 \u06a9\u0631 \u0627\u0633 \u0646\u062a\u06cc\u062c\u06d2 \u062a\u06a9 \u067e\u06c1\u0646\u0686\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u06cc\u06c1 \u062a\u0642\u0631\u06cc\u0628\u0627\u064b 60 \u0644\u0627\u0626\u0646\u0648\u06ba \u067e\u0631 \u0627\u06cc\u06a9 LSM \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0645 \u0631\u0642\u0645 \u0645\u0627\u0646\u06af \u06a9\u0631 \u062d\u0627\u0635\u0644 \u06a9\u06cc\u0627 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u062c\u0633 \u0645\u06cc\u06ba \u0627\u0646\u0633\u0679\u0627\u0644 \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0686\u06be \u0628\u06be\u06cc \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-finding-the-paths-a-program-needs\">\u0648\u06c1 \u0631\u0627\u0633\u062a\u06c1 \u062a\u0644\u0627\u0634 \u06a9\u0631\u06cc\u06ba \u062c\u0633 \u06a9\u06cc \u0622\u067e \u06a9\u06d2 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/h2>\n<p>\u0633\u06cc\u0646\u0688 \u0628\u0627\u06a9\u0633\u0632 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0645\u0634\u06a9\u0644 \u062d\u0635\u06c1 API \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0627\u06cc\u06a9 \u0641\u06c1\u0631\u0633\u062a \u06c1\u06d2\u06d4 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u062a\u0648\u0642\u0639 \u0633\u06d2 \u0632\u06cc\u0627\u062f\u06c1 \u06a9\u062b\u0631\u062a \u0633\u06d2 \u06a9\u06be\u0644\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u0628\u06be\u0648\u0644\u06d2 \u06c1\u0648\u0626\u06d2 \u0631\u0627\u0633\u062a\u06d2 \u0639\u0645\u0644\u062f\u0631\u0622\u0645\u062f \u06a9\u06d2 \u062f\u0648\u0631\u0627\u0646 \u06a9\u06c1\u06cc\u06ba \u0646\u0627\u06a9\u0627\u0645\u06cc\u0648\u06ba \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u0638\u0627\u06c1\u0631 \u06c1\u0648\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u062f\u0648 \u0679\u0648\u0644\u0632 \u0641\u06c1\u0631\u0633\u062a \u0628\u0646\u0627\u062a\u06d2 \u06c1\u06cc\u06ba: <code>ldd<\/code> \u0627\u06cc\u06a9 \u0645\u0634\u062a\u0631\u06a9\u06c1 \u0644\u0627\u0626\u0628\u0631\u06cc\u0631\u06cc \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u062c\u0633\u06d2 \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06d2 \u0642\u0627\u0628\u0644 \u06c1\u0648\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2 \u0648\u0631\u0646\u06c1 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0634\u0631\u0648\u0639 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u06af\u0627\u06d4<\/p>\n<pre><code class=\"language-bash\">ldd \/usr\/bin\/cat\n<\/code><\/pre>\n<pre><code class=\"language-text\">linux-vdso.so.1 (0x00007fff85f39000)\nlibc.so.6 => \/lib\/x86_64-linux-gnu\/libc.so.6 (0x00007f4f61bb5000)\n\/lib64\/ld-linux-x86-64.so.2 (0x00007f4f61e0a000)\n<\/code><\/pre>\n<p><code>strace<\/code>    \u0628\u0627\u0642\u06cc \u0633\u0628 \u06a9\u0686\u06be \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0633\u0628 \u0633\u06d2 \u067e\u06c1\u0644\u06d2\u060c \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u0648 \u0628\u063a\u06cc\u0631 \u06a9\u0633\u06cc \u067e\u0627\u0628\u0646\u062f\u06cc \u06a9\u06d2 \u0686\u0644\u0627\u0626\u06cc\u06ba \u0627\u0648\u0631 \u062c\u0648 \u06a9\u06be\u0644\u062a\u0627 \u06c1\u06d2 \u0627\u0633\u06d2 \u062c\u0645\u0639 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<pre><code class=\"language-bash\">strace -e trace=openat cat \/etc\/hostname 2>&1 | grep -oE '\"\/[^\"]+\"' | sort -u\n<\/code><\/pre>\n<pre><code class=\"language-text\">\"\/etc\/hostname\"\n\"\/etc\/ld.so.cache\"\n\"\/lib\/x86_64-linux-gnu\/libc.so.6\"\n\"\/usr\/lib\/locale\/locale-archive\"\n<\/code><\/pre>\n<p>\u0627\u06cc\u06a9 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u06d2 \u0686\u0627\u0631 \u0631\u0627\u0633\u062a\u06d2 \u06c1\u06cc\u06ba \u062c\u0648 \u0627\u06cc\u06a9 \u0641\u0627\u0626\u0644 \u06a9\u0648 \u067e\u0631\u0646\u0679 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u062c\u0646 \u0645\u06cc\u06ba \u0633\u06d2 \u0635\u0631\u0641 \u0627\u06cc\u06a9 \u062f\u0631\u062e\u0648\u0627\u0633\u062a \u06a9\u0631\u062f\u06c1 \u0641\u0627\u0626\u0644 \u06c1\u06d2\u06d4 \u0644\u0646\u06a9\u0631 \u06a9\u06cc\u0634\u06d2\u060c \u0633\u06cc \u0644\u0627\u0626\u0628\u0631\u06cc\u0631\u06cc\u060c \u0627\u0648\u0631 \u0644\u0648\u06a9\u06cc\u0644 \u0622\u0631\u06a9\u0627\u0626\u06cc\u0648\u0632 \u0633\u0628\u06be\u06cc \u06a9\u06cc \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2 \u0627\u0648\u0631 \u0627\u0633 \u0644\u06cc\u06d2 \u0631\u06cc\u067e\u0631 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0627\u062c\u0627\u0632\u062a \u062f\u06cc \u062c\u0627\u062a\u06cc \u06c1\u06d2\u06d4 <code>\/usr<\/code>\u060c <code>\/lib<\/code> \u0627\u0648\u0631 <code>\/etc<\/code> \u0627\u067e\u0646\u06cc \u067e\u0633\u0646\u062f \u06a9\u06cc \u0627\u062c\u0627\u0632\u062a \u062f\u06cc\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2\u06d4<\/p>\n<p>\u0627\u06cc\u06a9 \u0628\u0627\u0631 \u0645\u062d\u062f\u0648\u062f\u060c <code>strace<\/code> \u06cc\u06c1 \u0622\u067e \u06a9\u0648 \u06cc\u06c1 \u0628\u06be\u06cc \u0628\u062a\u0627\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0645\u0633\u062a\u0631\u062f \u06a9\u06cc\u0627 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-bash\">strace -f -e trace=openat .\/llrun \/tmp\/work cat \/tmp\/secret.txt 2>&1 | grep EACCES\n<\/code><\/pre>\n<pre><code class=\"language-text\">openat(AT_FDCWD, \"\/tmp\/secret.txt\", O_RDONLY) = -1 EACCES (Permission denied)\n<\/code><\/pre>\n<p>\u06cc\u06c1\u06cc \u0644\u0648\u067e \u06c1\u06d2\u06d4 \u0628\u06be\u0627\u06af\u0648 \u0627\u0648\u0631 \u067e\u0691\u06be\u0648\u06d4 <code>EACCES<\/code> \u0627\u0633 \u0628\u0627\u062a \u06a9\u0627 \u062a\u0639\u06cc\u0646 \u06a9\u0631\u06cc\u06ba \u06a9\u06c1 \u0622\u06cc\u0627 \u0642\u0637\u0627\u0631 \u0645\u06cc\u06ba \u06a9\u0648\u0626\u06cc \u0631\u0627\u0633\u062a\u06c1 \u0627\u0635\u0648\u0644 \u0633\u06cc\u0679 \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0622\u062a\u0627 \u06c1\u06d2 \u06cc\u0627 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u0648 \u0627\u0633 \u0631\u0627\u0633\u062a\u06d2 \u062a\u06a9 \u0646\u06c1\u06cc\u06ba \u067e\u06c1\u0646\u0686\u0646\u0627 \u0686\u0627\u06c1\u06cc\u06d2\u060c \u067e\u06be\u0631 \u062f\u06c1\u0631\u0627\u0626\u06cc\u06ba\u06d4 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u062e\u0648\u062f \u0627\u0633 \u062f\u0627\u0646\u0627 \u067e\u0631 \u06a9\u0686\u06be \u0646\u06c1\u06cc\u06ba \u0644\u06a9\u06be\u062a\u0627\u060c \u0644\u06c1\u0630\u0627 <code>strace<\/code> \u06cc\u06c1 \u0688\u06cc\u0628\u06af\u0631 \u06c1\u06d2\u06d4 6.15 \u0645\u06cc\u06ba \u062f\u0627\u0646\u0627 \u0622\u0688\u0679 \u0633\u0628 \u0633\u0633\u0679\u0645 \u06a9\u06d2 \u0630\u0631\u06cc\u0639\u06d2 \u0645\u0633\u062a\u0631\u062f \u06c1\u0648\u0646\u06d2 \u06a9\u06cc \u0627\u0637\u0644\u0627\u0639 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u060c \u0644\u06c1\u0630\u0627 \u063a\u06cc\u0631 \u0645\u0648\u062c\u0648\u062f \u0644\u0627\u06af\u0632 \u06a9\u0648 \u062a\u0644\u0627\u0634 \u06a9\u0631\u0646\u06d2 \u0633\u06d2 \u067e\u06c1\u0644\u06d2 \u0627\u067e\u0646\u0627 \u0648\u0631\u0698\u0646 \u0686\u06cc\u06a9 \u06a9\u0631\u06cc\u06ba\u06d4<\/p>\n<h2 id=\"heading-which-abi-version-you-have\">ABI \u0648\u0631\u0698\u0646 \u0627\u0633\u062a\u0639\u0645\u0627\u0644 \u0645\u06cc\u06ba \u06c1\u06d2\u06d4<\/h2>\n<p>\u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 5.13 \u06a9\u06d2 \u0628\u0639\u062f \u0633\u06d2 \u0628\u0691\u06be \u06af\u06cc\u0627 \u06c1\u06d2\u060c \u0644\u06c1\u0630\u0627 \u0622\u067e \u062c\u0646 \u062e\u0635\u0648\u0635\u06cc\u0627\u062a \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u067e\u0691\u06be\u062a\u06d2 \u06c1\u06cc\u06ba \u0648\u06c1 \u0622\u067e \u06a9\u06d2 \u062f\u0627\u0646\u0627 \u0645\u06cc\u06ba \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u0633\u06a9\u062a\u06cc \u06c1\u06cc\u06ba\u06d4 \u0628\u0631\u0627\u06c1 \u0631\u0627\u0633\u062a \u067e\u0648\u0686\u06be\u06cc\u06ba:<\/p>\n<pre><code class=\"language-c\">int v = syscall(__NR_landlock_create_ruleset, NULL, 0,\n                LANDLOCK_CREATE_RULESET_VERSION);\n<\/code><\/pre>\n<p>\u06cc\u06c1 \u0645\u0634\u06cc\u0646 \u0631\u067e\u0648\u0631\u0679 \u06a9\u0631\u062a\u06cc \u06c1\u06d2\u06d4 <code>1<\/code>\u06cc\u06c1 5.13 \u06a9\u0627 \u0627\u0635\u0644 \u0648\u0631\u0698\u0646 \u06c1\u06d2 \u0627\u0648\u0631 13 \u0641\u0627\u0626\u0644 \u0633\u0633\u0679\u0645 \u062a\u06a9 \u0631\u0633\u0627\u0626\u06cc \u0641\u0631\u0627\u06c1\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<pre><code class=\"language-bash\">grep -oE \"LANDLOCK_ACCESS_FS_[A-Z_]+\" \/usr\/include\/linux\/landlock.h | sort -u\n<\/code><\/pre>\n<pre><code class=\"language-text\">LANDLOCK_ACCESS_FS_EXECUTE      LANDLOCK_ACCESS_FS_MAKE_BLOCK\nLANDLOCK_ACCESS_FS_MAKE_CHAR    LANDLOCK_ACCESS_FS_MAKE_DIR\nLANDLOCK_ACCESS_FS_MAKE_FIFO    LANDLOCK_ACCESS_FS_MAKE_REG\nLANDLOCK_ACCESS_FS_MAKE_SOCK    LANDLOCK_ACCESS_FS_MAKE_SYM\nLANDLOCK_ACCESS_FS_READ_DIR     LANDLOCK_ACCESS_FS_READ_FILE\nLANDLOCK_ACCESS_FS_REMOVE_DIR   LANDLOCK_ACCESS_FS_REMOVE_FILE\nLANDLOCK_ACCESS_FS_WRITE_FILE\n<\/code><\/pre>\n<p>\u062a\u0627\u0632\u06c1 \u062a\u0631\u06cc\u0646 \u0648\u0631\u0698\u0646 \u0641\u0627\u0626\u0644 \u067e\u06cc\u0631\u0646\u0679\u0646\u06af\u060c \u062a\u0631\u0627\u0634\u0646\u0627\u060c TCP \u0628\u0627\u0626\u0646\u0688\u0646\u06af\u0632 \u0627\u0648\u0631 \u06a9\u0646\u06a9\u0634\u0646\u0632\u060c \u0627\u0648\u0631 \u0688\u06cc\u0648\u0627\u0626\u0633 ioctls \u06a9\u0627 \u0627\u062d\u0627\u0637\u06c1 \u06a9\u0631\u0646\u06d2 \u0648\u0627\u0644\u06d2 \u0646\u06cc\u0679 \u0648\u0631\u06a9 \u06a9\u06d2 \u0627\u0635\u0648\u0644\u0648\u06ba \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0646\u0679\u0631\u0648\u0644\u0632 \u06a9\u0627 \u0627\u0636\u0627\u0641\u06c1 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u06c1\u0631 \u0627\u06cc\u06a9 \u0627\u067e\u0646\u06d2 \u0627\u067e\u0646\u06d2 ABI \u0679\u06a9\u0631\u0627\u0646\u06d2 \u0633\u06d2 \u0679\u06a9\u0631\u0627\u062a\u0627 \u06c1\u06d2\u060c \u0644\u06c1\u0630\u0627 \u0646\u0626\u06cc \u0627\u062c\u0627\u0632\u062a\u0648\u06ba \u06a9\u06d2 \u062e\u0648\u0627\u06c1\u0634\u0645\u0646\u062f \u067e\u0631\u0648\u06af\u0631\u0627\u0645\u0648\u06ba \u06a9\u0648 \u0627\u0633\u062a\u0641\u0633\u0627\u0631 \u06a9\u0631\u0646\u06d2 \u0627\u0648\u0631 \u0648\u0631\u0698\u0646 \u06a9\u0648 \u0641\u0631\u0636 \u06a9\u0631\u0646\u06d2 \u06a9\u06cc \u0628\u062c\u0627\u0626\u06d2 \u06a9\u0627\u0631\u06a9\u0631\u062f\u06af\u06cc \u06a9\u0648 \u0642\u0631\u0628\u0627\u0646 \u06a9\u0631\u0646\u0627 \u067e\u0691\u06d2 \u06af\u0627\u06d4 \u0686\u0644\u0627\u0646\u06d2 \u0648\u0627\u0644\u0627 \u062f\u0627\u0646\u0627 \u0627\u0633 \u0628\u0627\u062a \u06a9\u06d2 \u0644\u06cc\u06d2 \u0627\u062c\u0627\u0632\u062a\u06cc\u06ba \u067e\u0627\u0633 \u06a9\u0631\u062a\u0627 \u06c1\u06d2 \u06a9\u06c1 \u0627\u0633\u06d2 \u0627\u0633 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0645\u0639\u0644\u0648\u0645 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 <code>landlock_create_ruleset<\/code> \u0646\u0627\u06a9\u0627\u0645 <code>EINVAL<\/code>\u0627\u06af\u0631 \u0622\u067e \u067e\u06c1\u0644\u06d2 \u0648\u0631\u0698\u0646 \u06a9\u0648 \u0686\u06cc\u06a9 \u0646\u06c1\u06cc\u06ba \u06a9\u0631\u062a\u06d2 \u06c1\u06cc\u06ba \u062a\u0648 \u0688\u06cc\u0628\u06af \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06cc\u06c1 \u0627\u06cc\u06a9 \u0645\u0628\u06c1\u0645 \u063a\u0644\u0637\u06cc \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-conclusion\">\u0646\u062a\u06cc\u062c\u06c1<\/h2>\n<p>\u0627\u0628 \u0622\u067e \u0628\u063a\u06cc\u0631 \u06a9\u0633\u06cc \u0627\u062c\u0627\u0632\u062a \u06cc\u0627 \u062a\u0631\u062a\u06cc\u0628 \u06a9\u06d2 \u0627\u0646\u062f\u0631 \u0633\u06d2 \u06a9\u0633\u06cc \u0639\u0645\u0644 \u06a9\u0648 \u0633\u06cc\u0646\u0688 \u0628\u0627\u06a9\u0633 \u06a9\u0631 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0648\u0631 \u0622\u067e \u0646\u06d2 \u0686\u0627\u0631 \u062d\u06cc\u0631\u0627\u0646 \u06a9\u0646 \u0686\u06cc\u0632\u06cc\u06ba \u0633\u06cc\u06a9\u06be\u06cc \u06c1\u06cc\u06ba: <code>no_new_privs<\/code> \u067e\u06c1\u0644\u06d2 \u0622\u062a\u0627 \u06c1\u06d2 \u06cc\u0627 \u06a9\u0686\u06be \u0628\u06be\u06cc \u0644\u0627\u06af\u0648 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 \u0627\u0635\u0648\u0644 \u0633\u06cc\u0679 \u062c\u0645\u0639 \u0646\u06c1\u06cc\u06ba \u06c1\u0648\u062a\u06d2 \u0628\u0644\u06a9\u06c1 \u0627\u06cc\u06a9 \u062f\u0648\u0633\u0631\u06d2 \u06a9\u0648 \u0622\u067e\u0633 \u0645\u06cc\u06ba \u062c\u0648\u0691\u062a\u06d2 \u06c1\u06cc\u06ba\u060c \u0627\u0633 \u0644\u06cc\u06d2 \u0627\u06cc\u06a9 \u0627\u0635\u0648\u0644 \u0633\u06cc\u0679 \u0628\u0646\u0627\u0626\u06cc\u06ba \u062c\u0633 \u0645\u06cc\u06ba \u0633\u0628 \u06a9\u0686\u06be \u06c1\u0648\u06d4 \u0628\u0686\u0648\u06ba \u06a9\u06cc \u062e\u0635\u0648\u0635\u06cc\u0627\u062a \u0648\u0631\u0627\u062b\u062a \u0633\u06d2 \u06c1\u0648\u062a\u06cc \u06c1\u06cc\u06ba\u06d4 \u0627\u0648\u0631 \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06cc \u062d\u062f \u0679\u0648\u0679 \u06af\u0626\u06cc \u06c1\u06d2\u06d4 <code>exec<\/code> \u062c\u0628 \u062a\u06a9 \u0628\u0627\u0626\u0646\u0631\u06cc \u0631\u0627\u0633\u062a\u0648\u06ba \u06a9\u06cc \u0628\u06be\u06cc \u0627\u062c\u0627\u0632\u062a \u0646\u06c1 \u06c1\u0648\u06d4<\/p>\n<p>\u0622\u067e \u06cc\u06c1\u0627\u06ba \u0633\u06d2 \u0686\u0646\u062f \u0633\u0645\u062a \u062c\u0627 \u0633\u06a9\u062a\u06d2 \u06c1\u06cc\u06ba\u06d4 \u0634\u0627\u0645\u0644 \u06a9\u0631\u06cc\u06ba <code>LANDLOCK_ACCESS_FS_WRITE_FILE<\/code> \u06a9\u0648 <code>handled_access_fs<\/code> \u0627\u06cc\u06a9 \u0627\u06cc\u0633\u0627 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u0628\u0646\u0627\u0626\u06cc\u06ba \u062c\u0648 \u0628\u0691\u06d2 \u067e\u06cc\u0645\u0627\u0646\u06d2 \u067e\u0631 \u067e\u0691\u06be \u0633\u06a9\u06d2\u060c \u0644\u06cc\u06a9\u0646 \u0635\u0631\u0641 \u0627\u06cc\u06a9 \u0688\u0627\u0626\u0631\u06a9\u0679\u0631\u06cc \u0645\u06cc\u06ba \u0644\u06a9\u06be \u0633\u06a9\u06d2\u06d4 \u0627\u067e\u0646\u06d2 \u0622\u067e \u06a9\u0648 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u06cc\u06ba \u0627\u0648\u0631 \u067e\u06be\u0631 \u0627\u0633 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u0648 \u0644\u067e\u06cc\u0679\u0646\u06d2 \u06a9\u06d2 \u0644\u06cc\u06d2 \u06a9\u0627\u0644 \u06a9\u0631\u06cc\u06ba \u062c\u0633\u06d2 \u0622\u067e \u0646\u06d2 \u0646\u06c1\u06cc\u06ba \u0644\u06a9\u06be\u0627\u06d4 <code>execve<\/code>. \u06cc\u0627 \u062f\u06cc\u06a9\u06be\u06cc\u06ba \u06a9\u06cc\u0627 \u06c1\u0648\u062a\u0627 \u06c1\u06d2\u06d4 <code>strace<\/code> \u0645\u0633\u062a\u0631\u062f\u0648\u06ba \u06a9\u06cc \u0627\u0637\u0644\u0627\u0639 \u062f\u06cc\u0646\u0627 \u0627\u0646 \u0631\u0627\u0633\u062a\u0648\u06ba \u06a9\u06cc \u0641\u06c1\u0631\u0633\u062a \u0628\u0646\u0627\u0646\u06d2 \u06a9\u0627 \u062a\u06cc\u0632 \u062a\u0631\u06cc\u0646 \u0637\u0631\u06cc\u0642\u06c1 \u06c1\u06d2 \u062c\u0646 \u06a9\u06cc \u0622\u067e \u06a9\u06d2 \u062d\u0642\u06cc\u0642\u06cc \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06a9\u0648 \u062f\u0631\u062d\u0642\u06cc\u0642\u062a \u0636\u0631\u0648\u0631\u062a \u06c1\u06d2\u06d4<\/p>\n<h2 id=\"heading-epilogue\">\u0627\u06cc\u067e\u06cc\u0644\u0627\u06af<\/h2>\n<p>\u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u062f\u0644\u0686\u0633\u067e \u0633\u0648\u0627\u0644 \u06cc\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u06a9\u06c1 \u06cc\u06c1 \u06a9\u06cc\u0627 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u06cc\u06c1 \u0627\u06cc\u0633\u06cc \u0686\u06cc\u0632 \u06c1\u06d2 \u062c\u0633 \u06a9\u0627 \u0627\u0638\u06c1\u0627\u0631 \u0646\u06c1\u06cc\u06ba \u06a9\u06cc\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627\u06d4 \u0642\u0648\u0627\u0639\u062f \u0633\u06cc\u0679 \u0627\u06cc\u06a9 \u0631\u0627\u0633\u062a\u06d2 \u06a9\u0627 \u0646\u0627\u0645 \u062f\u06cc\u062a\u0627 \u06c1\u06d2\u060c \u0644\u06c1\u0630\u0627 \u0627\u062c\u0627\u0632\u062a \u06cc\u0648\u0646\u0679 \u0641\u0627\u0626\u0644 \u0633\u0633\u0679\u0645 \u067e\u0631 \u0627\u06cc\u06a9 \u0645\u0642\u0627\u0645 \u06c1\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u0627\u0633 \u06a9\u06d2 \u06a9\u06c1 \u0635\u0627\u0631\u0641 \u06a9\u06cc \u0637\u0631\u0641 \u0633\u06d2 \u067e\u0627\u0633 \u06a9\u0631\u062f\u06c1 \u0645\u062e\u0635\u0648\u0635 \u0641\u0627\u0626\u0644\u06d4 \u0645\u06cc\u06ba \u0622\u067e \u06a9\u0648 \u0628\u062a\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u0648\u06ba \u06a9\u06c1 \u0627\u0633 \u0639\u0645\u0644 \u06a9\u0648 \u0646\u06cc\u0686\u06d2 \u067e\u0691\u06be\u0627 \u062c\u0627 \u0633\u06a9\u062a\u0627 \u06c1\u06d2\u06d4 <code>\/etc<\/code>. \u0627\u0633 \u06a9\u0627 \u0645\u0637\u0644\u0628 \u06cc\u06c1 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2 \u06a9\u06c1 \u06cc\u06c1 \u0639\u0645\u0644 \u0635\u0631\u0641 \u0627\u06cc\u06a9 \u0641\u0627\u0626\u0644 \u06a9\u0648 \u067e\u0691\u06be \u0633\u06a9\u062a\u0627 \u06c1\u06d2 \u062c\u0633\u06d2 \u0635\u0627\u0631\u0641 \u0646\u06d2 \u0627\u0628\u06be\u06cc \u0645\u0646\u062a\u062e\u0628 \u06a9\u06cc\u0627 \u06c1\u06d2 \u0627\u0648\u0631 \u062f\u0648\u0633\u0631\u06cc \u0646\u06c1\u06cc\u06ba\u06d4<\/p>\n<p>\u0648\u06c1 \u062e\u0644\u0627 \u06c1\u06d2 \u062c\u06c1\u0627\u06ba \u0645\u06cc\u06ba \u0646\u06d2 \u0622\u062e\u0631\u06cc \u0628\u0627\u0631 \u0627\u06cc\u06a9 \u0688\u06cc\u0633\u06a9 \u0679\u0627\u067e OS \u0628\u0646\u0627\u0646\u06d2 \u0645\u06cc\u06ba \u0627\u067e\u0646\u0627 \u0648\u0642\u062a \u0635\u0631\u0641 \u06a9\u06cc\u0627 \u062a\u06be\u0627 \u062c\u0633 \u0645\u06cc\u06ba \u0627\u06cc\u0633\u06cc \u062e\u0635\u0648\u0635\u06cc\u0627\u062a \u06a9\u06cc \u062d\u0645\u0627\u06cc\u062a \u06a9\u06cc \u06af\u0626\u06cc \u062a\u06be\u06cc \u062c\u06c1\u0627\u06ba \u0627\u062c\u0627\u0632\u062a\u06cc\u06ba \u0645\u0642\u0627\u0645 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba \u0642\u0648\u0627\u0639\u062f \u06a9\u06d2 \u0628\u062c\u0627\u0626\u06d2 \u0627\u06cc\u06a9 \u0622\u0628\u062c\u06cc\u06a9\u0679 \u06a9\u06d2 \u06c1\u06cc\u0646\u0688\u0644 \u06a9\u06d2 \u0637\u0648\u0631 \u067e\u0631 \u067e\u06c1\u0646\u0686\u06cc \u062a\u06be\u06cc\u06ba\u060c \u0627\u0648\u0631 \u0688\u06cc\u0628\u06cc\u0646 \u0645\u0627\u062d\u0648\u0644\u06cc\u0627\u062a\u06cc \u0646\u0638\u0627\u0645 \u0627\u0628 \u0628\u06be\u06cc \u0627\u0633 \u06a9\u06d2 \u0646\u06cc\u0686\u06d2 \u06a9\u0627\u0645 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u0628\u06c1\u062a \u0633\u0627\u0631\u06cc \u0686\u06cc\u0632\u06cc\u06ba \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u060c \u0627\u0648\u0631 \u062c\u06c1\u0627\u06ba \u0644\u06cc\u0646\u0688 \u0644\u0627\u06a9 \u0631\u06a9 \u062c\u0627\u062a\u0627 \u06c1\u06d2 \u0648\u06c1\u06cc\u06ba \u0688\u06cc\u0632\u0627\u0626\u0646 \u062f\u0644\u0686\u0633\u067e \u06c1\u0648 \u062c\u0627\u062a\u0627 \u06c1\u06d2\u06d4<\/p>\n<p>\u0645\u06cc\u06ba \u0646\u0638\u0627\u0645 \u0627\u0648\u0631 \u0627\u0633 \u06a9\u06d2 \u0627\u0633\u0631\u0627\u0631 \u06a9\u06d2 \u0628\u0627\u0631\u06d2 \u0645\u06cc\u06ba thechris.in \u067e\u0631 \u0644\u06a9\u06be\u062a\u0627 \u06c1\u0648\u06ba\u06d4<\/p>\n<\/p><\/div>\n","protected":false},"excerpt":{"rendered":"<p>\u06cc\u06c1\u0627\u06ba \u0627\u06cc\u06a9 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 \u06c1\u06d2 \u062c\u0648 \u062e\u0648\u062f \u06a9\u0648 \u0645\u062d\u062f\u0648\u062f \u06a9\u0631\u0646\u06d2 \u06a9\u06d2 \u0628\u0639\u062f \u062f\u0648 \u0641\u0627\u0626\u0644\u0648\u06ba \u06a9\u0648 \u067e\u0691\u06be\u0646\u06d2 \u06a9\u06cc \u06a9\u0648\u0634\u0634 \u06a9\u0631\u062a\u0627 \u06c1\u06d2\u06d4 without landlock: read \/etc\/hostname ok read \/tmp\/secret.txt ok with landlock, \/etc allowed: read \/etc\/hostname ok read \/tmp\/secret.txt FAILED (Permission denied) \u06a9\u0648\u0626\u06cc \u062c\u0691 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u060c \u06a9\u0648\u0626\u06cc \u06a9\u0646\u0679\u06cc\u0646\u0631 \u0646\u06c1\u06cc\u06ba\u060c \u06a9\u0648\u0626\u06cc \u062a\u0631\u062a\u06cc\u0628 \u0641\u0627\u0626\u0644\u06cc\u06ba\u060c \u0627\u0648\u0631 \u06a9\u0648\u0626\u06cc \u0688\u06cc\u0645\u0646 \u0646\u06c1\u06cc\u06ba \u06c1\u06d2\u06d4 \u067e\u0631\u0648\u06af\u0631\u0627\u0645 [&hellip;]<\/p>\n","protected":false},"author":7,"featured_media":29227,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[1],"tags":[],"class_list":["post-29226","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-blog"],"_links":{"self":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts\/29226","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/users\/7"}],"replies":[{"embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/comments?post=29226"}],"version-history":[{"count":1,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts\/29226\/revisions"}],"predecessor-version":[{"id":29228,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/posts\/29226\/revisions\/29228"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/media\/29227"}],"wp:attachment":[{"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/media?parent=29226"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/categories?post=29226"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/umang.pk\/ur\/wp-json\/wp\/v2\/tags?post=29226"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}