Landlock vs. Seccomp-BPF and Landlock Use Case in Kubernetes Serverless Frameworks

In some ways, it is similar to seccomp-bpf: using a BPF program, seccomp-bpf allows unprivileged processes to restrict what system calls they can perform. Landlock will be more powerful and provide more flexibility. Consider the following system call: ``` C fd = open(“myfile.txt”, O\_RDWR); ``` The first argument is a “char \*”, a pointer to a memory address, such as `0xab004718`. With seccomp, a BPF program only has access to the parameters of the syscall but cannot dereference the pointers, making it impossible to make security decisions based on a file. seccomp also uses classic BPF, meaning it cannot make use of eBPF maps, the mechanism for interfacing with user space. This restriction means security policies cannot be changed in seccomp-bpf based on a configuration in an eBPF map. BPF programs with Landlock don’t receive the arguments of the syscalls but a reference to a kernel object. In the example above, this means it will have a reference to the file, so it does not need to dereference a pointer, consider relative paths, or perform chroots. ## Use Case: Landlock in Kubernetes-based serverless frameworks In Kubernetes, the unit of deployment is a pod. Pods and containers are the main unit of isolation. In serverless frameworks, however, the main unit of deployment is a function. Ideally, the unit of deployment equals the unit of isolation. This puts serverless frameworks like [Kubeless](https://github.com/kubeless/kubeless) or [OpenFaaS](https://github.com/openfaas/faas) into a predicament: optimize for unit of isolation or deployment? To achieve the best possible isolation, each function call would have to happen in its own container—ut what's good for isolation is not always good for performance. Inversely, if we run function calls within the same container, we increase the likelihood of collisions. By using Landlock, we could isolate function calls from each other within the same container, making a temporary file created by one function call inaccessible to the next function call, for example. Integration between Landlock and technologies like Kubernetes-based serverless frameworks would be a ripe area for further exploration.

This passage contrasts Landlock with seccomp-bpf, explaining how Landlock provides more flexibility by allowing BPF programs to access kernel object references instead of syscall arguments, overcoming seccomp-bpf's limitations. It then discusses a use case for Landlock in Kubernetes-based serverless frameworks like Kubeless and OpenFaaS, where it can enhance isolation between function calls within the same container, balancing performance and security.