Installation

Landlock-Sharp is a tiny, pure-managed NuGet package. There is no native binary to install — the library makes Landlock syscalls directly through libc via [DllImport], so all you need is a Linux kernel that supports Landlock.

View on NuGet View on GitHub

Install the package

dotnet add package Landlock

Install-Package Landlock

<ItemGroup>
<PackageReference Include="Landlock" Version="*" />
</ItemGroup>

Runtime requirements

For the canonical table of what each ABI version adds, see the "Backwards and forwards compatibility" section of the landlock(7) man page. Landlock-Sharp encodes the same table in its ABI versions guide.

Distro support

Most modern distributions ship Landlock-enabled kernels, but some build with the feature compiled in and disabled by default. Check by running on the target host:

# Should print "Y" if Landlock is built into the kernel
zcat /proc/config.gz 2>/dev/null | grep CONFIG_SECURITY_LANDLOCK

# Or just query the ABI from your app:
dotnet run -e "Console.WriteLine(Sandbox.Landlock.GetAbiVersion());"
# Negative number → unsupported, otherwise the ABI version (1..6+)

The kernel documentation lists how each major distribution ships Landlock and how to enable it if your kernel was built with lsm= excluding landlock.

Supported platforms

Always gate on IsSupported()

Because Landlock is a Linux-only kernel feature, every public call into the library should be guarded:

using Sandbox;

if (Landlock.IsSupported())
{
    // Build and enforce a ruleset
}
else
{
    // Fall back: log a warning, run unsandboxed, or refuse to start —
    // your policy choice.
}

IsSupported() checks three things:

1. The host OS is Linux (OperatingSystem.IsLinux()).
2. The process architecture is x86-64.
3. landlock_create_ruleset(NULL, 0, LANDLOCK_CREATE_RULESET_VERSION) returns a positive ABI version.

You can also call Landlock.GetAbiVersion() directly to learn which features are available — the ABI versions page walks through how to use that.

.NET target frameworks

Landlock-Sharp targets .NET 6.0+. It uses no platform-specific NuGet dependencies — the only P/Invoke target is libc, which is always present on Linux.

There are no native binaries shipped inside the NuGet package and no runtimes/ folder to worry about during publish. Self-contained, framework-dependent, and single-file publishes all work without extra MSBuild flags.

Verify the install

Create a tiny console app and run it — if it prints a positive ABI version, you're set.

using Sandbox;

if (!Landlock.IsSupported())
{
    Console.WriteLine("Landlock not supported on this host.");
    return;
}

Console.WriteLine($"Landlock ABI version: {Landlock.GetAbiVersion()}");

dotnet add package Landlock
dotnet run
# Landlock ABI version: 5