Landlock-Sharp

Guides

End-to-end recipes for the patterns you'll reach for most often when sandboxing a .NET process with Landlock.

Filesystem rules

AddPathBeneathRule, allowed actions, multiple paths, read-only vs read-write trees.

Network rules

AddPortRule for TCP BIND and CONNECT. Requires Landlock ABI 4 (kernel 6.7+).

IPC scopes

Block abstract Unix sockets and inbound signals. Requires Landlock ABI 6 (kernel 6.12+).

Enforcing the sandbox

Thread vs process scope, child inheritance, layering, and the "no widening" rule.

Deny logging

Control how the kernel audits denied accesses. Requires Landlock ABI 7 (kernel 6.13+).


For the kernel-side reference, the landlock(7) man page and the Linux kernel Landlock docs are the canonical source of truth. These guides explain how the C# binding maps onto them.

© 2026 Landlock-Sharp. All rights reserved.