[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fYBL5ILgn_QPqWV6y2USStndPeNr-vLTfGMmDXJ1yZaI":3},{"item":4,"related":44},{"id":5,"type":6,"title":7,"slug":8,"summary":9,"body":10,"coverUrl":11,"productScreenshots":12,"productLinks":13,"authorName":14,"authorUrl":15,"authorSubject":16,"category":17,"tags":22,"sourceLabel":35,"sourceName":36,"sourceUrl":37,"status":38,"seoTitle":7,"seoDescription":9,"canonicalUrl":35,"isFeatured":39,"sno":40,"sortOrder":41,"publishedAt":42,"updatedAt":43,"createdAt":43},"bea4c8f0-81ed-470a-aca7-7cea9f6f81e2","article","Landlock：普通程序也能给自己加一道 Linux 沙箱吗？","landlock-linux-unprivileged-sandbox","Landlock 允许 Linux 程序在已有权限基础上进一步收紧自身访问范围。本文用门禁比喻说明它如何建立可叠加的沙箱规则，也解释已打开文件描述符、内核支持和配置时机带来的安全边界。","给程序加沙箱，听上去像是管理员给它围一圈墙。但 Linux 上还有一种更有意思的思路：程序可以主动给自己加限制，让后续代码只能访问明确允许的资源。Landlock 就是 Linux 安全模块中的一种机制，重点是让普通用户运行的程序也能逐步收紧自身权限。\n\n通常情况下，进程继承用户身份、文件权限和系统安全策略。如果一个桌面应用只需要读写自己的工作目录，却因为账户权限而能访问更多文件，攻击者一旦利用了应用漏洞，影响范围就可能扩大。Landlock 允许程序在运行早期声明一套规则，例如限制它之后可以访问哪些文件系统路径，或按支持的规则限制网络相关操作。规则一旦生效，会叠加在进程原有权限上，而不是替代传统权限或系统管理员配置。\n\n“叠加”是理解 Landlock 的核心。进程不能借它凭空获得新权限，只能收窄可做的事情；多层规则可以继续增加限制。就像一个人原本有钥匙能进入多栋楼，Landlock 让他为自己再加一道门禁，而不能因此拿到新的钥匙。对于大型软件，这种自我约束可以分阶段启用：先完成初始化，再在处理不可信输入前进入更受限的环境。\n\n这种能力对浏览器、文档查看器、构建工具和处理外部文件的应用很有吸引力。假设某个图片解码库发现了恶意文件，它所在的受限进程就不应因此轻易扫描用户整个家目录。不过，沙箱能挡住什么取决于规则覆盖面、内核支持和应用是否正确设置；Landlock 不是自动识别恶意行为的检测器。\n\n还有一些容易忽略的边界：已经打开的文件描述符、进程继承关系、具体内核版本支持的规则类型，都会影响最终限制效果。程序若在启用规则前就打开了敏感文件，之后再加一道路径规则未必能撤销已经拿到的访问能力。因此，安全设计应尽早收紧权限，并针对实际系统验证行为，而不能只看代码里调用了 Landlock。\n\nLandlock 的价值在于把一部分隔离能力交给应用开发者，让软件即使以普通用户身份运行，也能“只拿完成任务所需的最少权限”。它适合做纵深防御的一层；要构建可靠沙箱，还应结合进程隔离、文件权限、容器策略以及系统更新。\n\n来源：[Linux 内核文档：Landlock](https:\u002F\u002Fdocs.kernel.org\u002Fuserspace-api\u002Flandlock.html)","\u002Fuploads\u002F2026-10-13\u002Fac24d1ab-7ec6-408a-9c58-7eb84e781241.jpg",[],[],"Foundit","https:\u002F\u002Ffoundit.cn","foundit-ai-editorial",{"id":18,"name":19,"slug":20,"description":21},"6179d3b6-dc34-4483-9ded-3cd9f1b37a47","科普","abbreviation","介绍各领域新兴概念",[23,27,31],{"id":24,"name":25,"slug":26},"7c76bfc2-f80f-4ee0-a95d-27bd8708b434","技术","slug",{"id":28,"name":29,"slug":30},"a202d639-99a6-488a-a712-4d4c6ffd7e15","开发","dev",{"id":32,"name":33,"slug":34},"4c2bbea6-eab7-40a8-8447-1de478ff7749","分析","analyse",null,"Linux Kernel Documentation","https:\u002F\u002Fdocs.kernel.org\u002Fuserspace-api\u002Flandlock.html","published",false,49,0,"2026-10-13T00:00:00.000Z","2026-10-13T02:13:33.293Z",[45,54,63],{"id":46,"type":6,"title":47,"slug":48,"summary":49,"coverUrl":50,"authorName":14,"sno":51,"publishedAt":52,"createdAt":53},"9ccde95c-d754-4808-91f7-488f392e3eeb","你的品牌在AI眼里到底存不存在？这套系统说了算","automated-geo-monitoring-system","靠手动抽查来验证GEO效果，本质上是在跟概率玩游戏。赢一次，不代表能一直赢。","\u002Fuploads\u002F2026-08-07\u002Fdf111c0d-f14a-4b2a-8347-141e96b71654.jpg",1,"2026-08-07T00:00:00.000Z","2026-08-07T04:31:30.843Z",{"id":55,"type":6,"title":56,"slug":57,"summary":58,"coverUrl":59,"authorName":14,"sno":60,"publishedAt":61,"createdAt":62},"9865c835-21fc-4f74-b154-19c054173557","fscrypt：只给手机里的某个文件夹加密，系统怎么做到？","linux-fscrypt-file-based-encryption","Linux fscrypt 在支持的文件系统中为目录树、文件内容和文件名提供文件级加密。它与整盘加密保护的范围不同，也不会隐藏所有文件系统元数据；本文从解锁密钥说到备份与恢复的边界。","\u002Fuploads\u002F2026-10-17\u002Fdec803fe-0da3-4a9e-8ffc-47427cf599d6.jpg",41,"2026-10-17T00:00:00.000Z","2026-10-17T03:08:37.641Z",{"id":64,"type":6,"title":65,"slug":66,"summary":67,"coverUrl":68,"authorName":14,"sno":69,"publishedAt":42,"createdAt":70},"56d3ebcb-170a-4f96-9134-ae85fb65542b","DANE\u002FTLSA：DNSSEC 能否帮助验证网站的 TLS 证书？","dane-tlsa-dnssec-tls-authentication","DANE 使用 DNS 中的 TLSA 记录发布与 TLS 服务证书或公钥相关的约束，并依赖 DNSSEC 验证记录来源。本文解释它如何补充信任路径，以及为什么它不等于所有网站都能抛弃 CA。","\u002Fuploads\u002F2026-10-13\u002F8c7d9bf5-62c6-47d4-b8eb-c4db7a21fa61.jpg",42,"2026-10-13T02:13:55.563Z"]