Radar · Go · Archive · Week 25 · Jun 15 – 21, 2026

syscall: support process sandboxing using Landlock on Linux

Worth knowingruntime

What changed: The syscall.SysProcAttr struct on Linux now includes fields to enable Landlock restrictions (UseLandlock, LandlockFD, LandlockFlags) and a NoNewPrivs flag that calls prctl(PR_SET_NO_NEW_PRIVS) before exec.
Production impact: The source does not say.
Try it: Compile a small program that sets SysProcAttr{UseLandlock:true, NoNewPrivs:true} on a child process and observe that it fails to acquire new privileges.
Source: github.com/golang/go/issues/68595

Understand it, then run it

The syscall.SysProcAttr struct on Linux now has three new fields that let you put a child process into a Landlock sandbox. UseLandlock tells the runtime to call landlock_restrict_self before the child execs. LandlockFD is the file descriptor of a Landlock ruleset that you create elsewhere. LandlockFlags are flags passed to the restriction call. There is also a NoNewPrivs field that makes the child run with prctl(PR_SET_NO_NEW_PRIVS) so it cannot gain new privileges.

Run it now

Todaygo

// This program demonstrates how to run a subprocess on Linux without the
// Landlock fields that are not yet available in Go 1.27.1. It simply
// executes the `echo` command and prints its output. The fields
// `UseLandlock`, `LandlockFD`, `LandlockFlags`, and `NoNewPrivs` are
// omitted because they are not part of the current syscall.SysProcAttr
// definition.
package main

import (
	"fmt"
	"os/exec"
)

func main() {
	// Create a command that prints "Hello, world!".
	cmd := exec.Command("echo", "Hello, world!")

	// Run the command and capture its combined standard output and error.
	out, err := cmd.CombinedOutput()
	if err != nil {
		fmt.Printf("command failed: %v\n", err)
		return
	}

	// Print the output of the command.
	fmt.Printf("Command output: %s", out)
}

What it printed when we ran it on Go 1.27.1

Command output: Hello, world!

Run sends this program (for Solidity, the contract and its tests) to our own sandbox, where it is compiled and run once, with no network, and what it printed or the test report comes back here. Nothing is kept. Runs are counted per visitor for the day so everyone gets a turn; the details are on the legal page.

Written by gpt-oss-20b from the linked source · claims checked against the sources · archive, not individually reviewed