How to Sandbox a Linux Process with Landlock, No Root Required

Here's a program restricting itself, then trying to read two files: without landlock: read /etc/hostname ok read /tmp/secret.txt ok with landlock, /etc allowed: read /etc/hostname ok read /tmp/secret.txt FAILED (Permission denied) There's no root, no container, no configuration file, and no daemon. The program asked the kernel to take away its own...