Lesson 4 of 9 · 8 min read
Linux Sandboxing Primitives: Namespaces, cgroups, seccomp and Landlock
Linux has no single sandbox feature. Containers and sandboxes combine primitives that each answer a different question: namespaces decide what a process can see, cgroups how much it can use, capabilities which root powers remain, Landlock or a security module which files and ports it may touch, and seccomp which system calls it may make. no_new_privs ties them together by stopping privilege gain through exec. They must be applied in the right order, and all of them are enforced by one shared kernel, so they harden a process but do not isolate hostile code from a kernel bug.
free sign-in, no card required
Practise it as an interviewer asks it
Compare the Android and iOS security models. What does each platform guarantee an app, and what does it not?Containers, gVisor, microVMs and VMs: where is each isolation boundary?How does the Android application sandbox work, and what role do app signing and permissions play?How do Unix file permissions work, including directories, setuid, setgid and the sticky bit?A Linux service running as a non-root user is compromised. What decides whether the attacker can become root, and what do you check?Design a sandbox for agent-generated code, including filesystem, network egress and GPU constraints.