Skip to content

Conversation

kaathewisegit
Copy link
Contributor

Description

This PR adds the self landlock command which applies a Landlock jail to the current Nu process

User-Facing Changes

  • A new self command, of which self landlock is a subcommand.
  • self landlock which can be used to restrict filesystem and network access of the current Nushell running process.

After Submitting

TODO: docs

Closes #16269

@kaathewisegit kaathewisegit marked this pull request as draft August 11, 2025 11:59
@132ikl
Copy link
Member

132ikl commented Aug 13, 2025

I absolutely see the use-case here, and this can't really be done with a plugin, but at the same time I really worry about adding such substantial platform-specific features that we will have to continue to support. I especially am concerned about the fact that this could potentially cause security issues for users if there is ever an issue/oversight in the implementation. I hate to reject this outright but I am worried about the additional complexity and risks that adding this, and potentially similar commands, would add to Nushell.

@kaathewisegit
Copy link
Contributor Author

kaathewisegit commented Aug 13, 2025

I'd like to push back on the additional complexity part. The landlock library is well-maintained because it's developer is the same person who's developing the Landlock LSM itself. I think that security is an important matter, and there's a lot of stuff in Nushell core. To give one example, there's even Excel 1 parsing (!).

I understand that it's very platform-specific, but I think that's reasonable. Some platforms have features others don't. ls --long varies by platform because of that, and there's also ulimit, because to daily drive a shell on Linux you can't use only the common subset. And there's registry query on Windows, too.

To sum up, I think that this is a small but very useful command, which only depends on one additional well-maintained crate, so it's reasonable to add it

Footnotes

  1. via from xlsx, and there's also a parser for OpenDocument spreadsheets

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

landlock for Linux builds of Nu
2 participants