Where/how was landlock supposed to be used? I guess you cannot really use it in a generic library like compression/decompression. The library has no clue what the program is supposed to do and what should be restricted. For a program it might be clearer. The sshd attack was using liblzma as a library. So disabling landlock seems unrelated? A sign that there is more bad code waiting to be detected / had been planned t…
Presumably sshd itself used to lock down its own capabilities after a certain point of execution. Removing the landlock means the daemon doesn’t lock itself down and will allow for better payload execution when they get to the exploitation stage. I don’t think these two things are unrelated. I think they already had payloads in mind and realized this would be a hurdle.
Re: Xz: Can you spot the single character that disabled Linux landlock?
#321Providing answers to things you have no clue about is worse than providing no answer at all.