Last updated 31 August 2026

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

The following vulnerability in util-linux was announced (taken from http://seclists.org/oss-sec/2015/q3/423):

""" If the chfn and chsh binaries (both setuid-root) from util-linux/login-utils are compiled WITHOUT libuser support, they eventually call mkostemp(localtmp, ORDWR|OCREAT|OEXCL|OCLOEXEC); where localtmp is "/etc/%s.XXXXXX" and %s is progname (i.e., argv[0]'s basename).

An attacker could repeatedly execve chfn as "ld.so" until mkostemp() creates "/etc/ld.so.preload" (after a few days, in our tests). This particular example doesn't actually work, because "preload" is 7 chars and "XXXXXX" is 6 chars, but it seems there are other interesting possibilities, like "/etc/rc.status" and "/etc/krb5.keytab".

The impact of this vulnerability is probably very limited: most Linux distributions ship either the chfn/chsh binaries from the shadow-utils (NOT the login-utils ones), or the login-utils ones but WITH libuser support. """

Upstream patch: https://github.com/karelzak/util-linux/commit/bde91c85bdc77975155058276f99d2e0f5eab5a9

A flaw was found in util-linux's libmount. An issue related to parsing the /proc/self/mountinfo file allows an unprivileged user to unmount other users' filesystems that are either world-writable themselves (like /tmp) or mounted in a world-writable directory.

A logic error was found in the libmount library of util-linux in the function that allows an unprivileged user to unmount a FUSE filesystem. This flaw allows an unprivileged local attacker to unmount FUSE filesystems that belong to certain other users who have a UID that is a prefix of the UID of the attacker in its string form. An attacker may use this flaw to cause a denial of service to applications that use the affected filesystems.

A flaw was found in the util-linux chfn and chsh utilities when compiled with Readline support. The Readline library uses an "INPUTRC" environment variable to get a path to the library config file. When the library cannot parse the specified file, it prints an error message containing data from the file. This flaw allows an unprivileged user to read root-owned files, potentially leading to privilege escalation. This flaw affects util-linux versions prior to 2.37.4.

An issue was discovered in hwclock.13-v2.27 allows attackers to gain escalated privlidges or execute arbitrary commands via the path parameter when setting the date.

(a) mount and (b) umount in util-linux 2.14.1, 2.17.2, and probably other versions allow local users to determine the existence of restricted directories by (1) using the --guess-fstype command-line option or (2) attempting to mount a non-existent device, which generates different error messages depending on whether the directory exists.

A flaw was reported in colcrt:

When running colcrt with a big input it crashes because of a global-buffer-overflow caused by a global variable 'page' defined in 'text-utils/colcrt.c:73:9

It is unclear whether this can be used to execute code on the system.

Proposed patches:

https://github.com/kerolasa/lelux-utiliteetit/commit/70e3fcf293c1827a2655a86584ab13075124a8a8 https://github.com/kerolasa/lelux-utiliteetit/commit/d883d64d96ab9bef510745d064a351145b9babec

The parsedosextended function in partitions/dos.c in the libblkid library in util-linux allows physically proximate attackers to cause a denial of service (memory consumption) via a crafted MSDOS partition table with an extended partition boot record at zero offset.

Here is the fourth Landlock newsletter!

Official website: https://landlock.io Previews newsletter: https://lore.kernel.org/landlock/d4ed5733-d07b-5548-2534-a63e22906778 () digikod net

Articles and conferences ------------------------

We wrote a detailed article about Landlock explaining the underlying concepts, the implementation, and the community: https://landlock.io/talks/2024-06-06landlock-article.pdf This was written for the SSTIC conference: https://www.sstic.org/2024/presentation/landlock-design/

I did a workshop at the Pass the Salt conference to explain how to mitigate security vulnerabilities with Landlock (demonstrated with ImageMagick): https://cfp.pass-the-salt.org/pts2024/talk/8FVYDF/ Related materials are freely available to do it at home: https://github.com/landlock-lsm/workshop-imagemagick

Arto Niemi published a "Survey of Real-World Process Sandboxing" at the Conference of Open Innovations Association (FRUCT): https://fruct.org/publications/volume-35/fruct35/files/Niem.pdf Their conclusion: "[...] we found Landlock and minijail [which uses Landlock] to be relatively convenient from a developer perspective. In general, process self-containment and process-wrapping seems to be an order of magnitude easier to configure than MAC policies."

Researchers from University of Bergamo gave a talk at ASIA CCS conference about Cage4Deno: A Fine-Grained Sandbox for Deno Subprocesses (leveraging Landlock) https://cs.unibg.it/seclab-papers/2023/ASIACCS/paper/cage4deno.pdf They also gave a talk at the RAID conference about NatiSand: Native Code Sandboxing for JavaScript Runtimes (leveraging Landlock) https://cs.unibg.it/seclab-papers/2023/RAID/natisand.pdf

Eric Leblond gave a talk (in French) at the SSTIC conference about sandboxing with Landlock to mitigate real world security issues: https://www.sstic.org/2023/presentation/attaquesupplychainsuricata/

Günther Noack will give a talk at LSS Europe about Landlock and the new IOCTL support: https://sched.co/1ebVW

I'll give a talk at OSS Europe to better explain sandboxing with Landlock: https://sched.co/1ej3a

The XZ backdoor ---------------

XZ Utils is a widely used compression tool and library. The main maintainer implemented sandboxing with Landlock, and released a new version 5.6.0 with this feature. In March 2024, a backdoor was found and reported. It was introduced in February by a new maintainer who earned this trust after more than two years of effort.

Among the malicious changes, the attacker disabled Landlock's support for XZ Utils and released a new version 5.6.1: https://research.swtch.com/xz-timeline The sabotaged configuration check has since been fixed with version 5.6.2, but this effort to stealthily disable sandboxing is a clear sign that Landlock disturbs attackers: https://github.com/tukaani-project/xz/commit/f9cf4c05edd1

Merged kernel features ----------------------

Linux 6.7 (Landlock ABI 4) supports initial network access control with the LANDLOCKACCESSNETBINDTCP and LANDLOCKACCESSNETCONNECTTCP rights thanks to Konstantin Meskhidze. We can now control inbound and outbound TCP connections according to the source or the destination port. This led to kernel code refactoring which opens the way to more network protocol support. See user space documentation: https://docs.kernel.org/userspace-api/landlock.html#network-flags

Linux 6.10 (Landlock ABI 5) supports IOCTL control with the new LANDLOCKACCESSFSIOCTLDEV right thanks to Günther Noack. This restriction only applies to IOCTL commands implemented by device drivers (i.e. block or character devices). As other file system access rights, this can be used to only allow such IOCTL commands on a specified set of file hierarchies per sandbox. See user space documentation: https://docs.kernel.org/userspace-api/landlock.html#filesystem-flags

We also added a slight change in all supported kernels to inform system administrators (with kernel logs) how they can configure the system to support Landlock, if a process tried to sandbox itself on a kernel where Landlock is disabled. New documentation will help enable Landlock on systems when it is not already the case: https://docs.kernel.org/userspace-api/landlock.html#kernel-support

Since Linux 6.3, we improved documentation and kselftests (user space testing), and added support for KUnit (kernel testing). Part of this work lead us to support the UML architecture to easily run application tests in a CI against different kernel versions. With this support we can make sure that backward compatibility works fine for the tested applications. I encourage to take a look at landlock-test-tools and the GitHub CI configuration for the Rust library: https://github.com/landlock-lsm/landlock-test-tools https://github.com/landlock-lsm/rust-landlock/blob/main/.github/workflows/rust.yml#L166-L179

Roadmap and ongoing development -------------------------------

We created GitHub issues to track ongoing and future work: https://github.com/landlock-lsm/linux/issues https://github.com/orgs/landlock-lsm/projects/1

Feel free to reach out if you want to contribute! https://github.com/landlock-lsm/linux/contribute

We also plan to improve the website with extended documentation and examples.

Kernel development highlights -----------------------------

Günther Noack is now an official reviewer of Landlock! https://git.kernel.org/torvalds/c/5bf9e57e634b After the IOCTL feature, he is now working on improving the documentation, including man pages.

Mikhail Ivanov is working on socket type control. This is an important feature that will make it possible to create sandboxes without any network access, except for an explicit list of allowed protocols. This will nicely complement the TCP port control (and future ones for other protocols): https://github.com/landlock-lsm/linux/issues/6 He is also working on controlling TCP listen calls: https://github.com/landlock-lsm/linux/issues/15

Tahera Fahimi was selected as an Outreachy intern to work on IPC restrictions (e.g. abstract unix socket, signals) to better isolate a Landlock domain: https://github.com/landlock-lsm/linux/issues/7 https://github.com/landlock-lsm/linux/issues/8

I'm working on bringing audit support to Landlock: https://github.com/landlock-lsm/linux/issues/3

Landlock libraries ------------------

As explained by Günther Noack, the Go library now supports TCP and IOCTL restrictions: https://blog.gnoack.org/post/landlock-v4/ https://blog.gnoack.org/post/landlock-ioctl/

A new version of the Rust crate was released, with support for TCP control and some miscellaneous improvements: https://github.com/landlock-lsm/rust-landlock/releases/tag/v0.4.0

Please update your dependencies and use the latest Landlock ABI version for improved sandboxing.

We are also working on a new minimal C library: https://github.com/landlock-lsm/linux/issues/38

New Landlock user space supports --------------------------------

Firejail 0.9.74 (sandboxer) will be able to use landlock: https://github.com/netblue30/firejail/pull/6078

setpriv 2.40 (sandboxer): https://github.com/util-linux/util-linux/pull/2628

extrasafe 0.4.0 (sandbox library): https://github.com/boustrophedon/extrasafe/pull/28

bevymodlockdown (sandbox library): https://github.com/FrTerstappen/bevymodlockdown

Cloud Hypervisor (VM monitor) will be sandboxed with Landlock: https://github.com/cloud-hypervisor/cloud-hypervisor/pull/6214

Ukuleleweb (wiki server): https://github.com/gnoack/ukuleleweb/commit/0ecdd54b36fa

websrv 3.2.0 (web server): https://github.com/ngergs/websrv/commit/40fa2d7d2bbb

egress-eddie 0.5.0 (network filtering): https://github.com/capnspacehook/egress-eddie/releases/tag/v0.5.0

Suricata 7.0.0 (network security monitoring engine): https://docs.suricata.io/en/latest/configuration/landlock.html

sslh 2.1.0 (protocol multiplexer): https://lore.kernel.org/landlock/Zfq6f30spnYCx9Y () rutschle net/ https://github.com/yrutschle/sslh/releases/tag/v2.1.0

wireproxy 1.0.8 (Wireguard client): https://github.com/pufferffish/wireproxy/pull/108

Emilua 0.5.0 (Lua runtime): https://lore.kernel.org/landlock/CAK9RveLxro4zUG4jfFB=UNgcv5gdc8JuzNhMt=YbNhH=35ADzg () mail gmail com/ https://docs.emilua.org/api/0.5/changelog.html

Polkadot (blockchain SDK): https://github.com/paritytech/polkadot/pull/7303

XZ Utils 5.6.2 (archive manager): https://github.com/tukaani-project/xz/commit/374868d81d47

Zathura (document viewer) will be sandboxed with Landlock: https://github.com/pwmt/zathura/pull/575

Pacman 7.0.0 (Arch Linux's package manager): https://gitlab.archlinux.org/pacman/pacman/-/mergerequests/167

Thanks to all contributors!

Regards, Mickaël

Common Vulnerabilities and Exposures assigned an identifier CVE-2011-1676 to the following vulnerability:

Name: CVE-2011-1676 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-1676 Assigned: 20110409 Reference: http://openwall.com/lists/oss-security/2011/03/04/11 Reference: http://openwall.com/lists/oss-security/2011/03/04/9 Reference: http://openwall.com/lists/oss-security/2011/03/04/10 Reference: http://openwall.com/lists/oss-security/2011/03/04/12 Reference: http://openwall.com/lists/oss-security/2011/03/05/3 Reference: http://openwall.com/lists/oss-security/2011/03/05/7 Reference: http://openwall.com/lists/oss-security/2011/03/07/9 Reference: http://openwall.com/lists/oss-security/2011/03/14/5 Reference: http://openwall.com/lists/oss-security/2011/03/14/7 Reference: http://openwall.com/lists/oss-security/2011/03/14/16 Reference: http://openwall.com/lists/oss-security/2011/03/15/6 Reference: http://openwall.com/lists/oss-security/2011/03/22/4 Reference: http://openwall.com/lists/oss-security/2011/03/22/6 Reference: http://openwall.com/lists/oss-security/2011/03/31/3 Reference: http://openwall.com/lists/oss-security/2011/03/31/4 Reference: http://openwall.com/lists/oss-security/2011/04/01/2 Reference: https://bugzilla.redhat.com/showbug.cgi?id=688980

mount in util-linux 2.19 and earlier does not remove the /etc/mtab.tmp file after a failed attempt to add a mount entry, which allows local users to trigger corruption of the /etc/mtab file via multiple invocations.