Package: wnpp Severity: wishlist Owner: Yunseong Kim <[email protected]> X-Debbugs-Cc: [email protected]; [email protected]
* Package name : island Version : 0.0.0+git20260522.05a9d69 Upstream Contact: Mickaël Salaün <[email protected]> * URL : https://github.com/landlock-lsm/island * License : MIT or Apache-2.0 Programming Lang: Rust Description : user-friendly command-line sandboxing tool powered by Linux Landlock Island makes the Landlock Linux Security Module practical for everyday workflows. It runs existing, unmodified programs in a sandbox whose filesystem, network and IPC access rights are described by declarative TOML profiles. Profiles are selected automatically from the current working directory and can be layered (a more specific profile can only reduce the access granted by its parents). Island also gives each workspace isolated XDG and temporary directories, and provides an optional Zsh hook that transparently sandboxes the commands typed in the shell. No root privileges or special capabilities are needed. * why is this package useful/relevant? is it a dependency for another package? do you use it? if there are other packages providing similar functionality, how does it compare? The archive already has per-invocation Landlock launchers: landrun and go-landlock's landlock-restrict, where the allowed paths and ports are given as command-line flags on every invocation. Island targets a different workflow: persistent, declarative profiles (in the Landlock Config format) bound to directories, chosen automatically from the current working directory, composable in layers, and combined with per-workspace XDG/TMPDIR isolation and a shell hook, so that commands run in a project are sandboxed without wrapping each one. It is developed by the Landlock kernel maintainers alongside the kernel feature and the "landlock" Rust crate (librust-landlock-dev), and is the tool the landlockconfig project itself recommends to end users. Packaging plan and dependencies: - Built with dh-cargo against the Debian Rust crate registry. All crate dependencies are already in unstable (clap 4.6, clap_complete 4.6, landlock 0.4.7, libc 0.2, serde 1.0, tempfile 3.27, thiserror 2.0, toml 0.8), except landlockconfig. - landlockconfig (same upstream, MIT or Apache-2.0) will be packaged first as rust-landlockconfig (librust-landlockconfig-dev) by the Debian Rust team in debcargo-conf, as soon as upstream publishes it on crates.io (only a 0.0.0 placeholder exists today). island will only be uploaded once rust-landlockconfig has been accepted into unstable. - Upstream has not tagged a release yet, hence the git snapshot version. Upstream describes the project as work in progress. * how do you plan to maintain it? inside a packaging team (check list at https://wiki.debian.org/Teams)? are you looking for co-maintainers? do you need a sponsor? I plan to maintain this package myself on Salsa (https://salsa.debian.org/debian/island). I need a sponsor; the package will be uploaded to mentors.debian.net. Co-maintenance by the Debian Rust Team is welcome.
