Landlock

A wall built into the Linux kernel itself — the backstop for when an agent never even calls the gate.

The gate only works if the agent asks it. Landlock covers the case where it doesn’t. Landlock is a Linux kernel security module: a process can ask the kernel to permanently restrict which parts of the filesystem it — and every child process it spawns — may touch. Once installed, the restriction is enforced below the application, by the kernel, on every relevant syscall. No cooperation from the agent is required.

Why a second wall

The gate is a check the agent chooses to run before acting. Landlock is a boundary the agent cannot step over even if it skips the check, has a bug, or is told to do something malicious. Defence in depth: the gate reasons about intent; Landlock constrains capability.

The shim that installs it

Agents are launched through a small wrapper — the shim. For Claude Code, the shim installs the Landlock restrictions on itself and then executes the real binary (claude-real). Because Landlock restrictions are inherited, everything the agent then spawns — the editor, git, shell commands — runs inside the same wall for the life of the process.

  launch ─▶ shim ─▶ install Landlock on self ─▶ exec claude-real
                          │                            │
                          │  (restrictions inherited)  ▼
                          └──────────────▶ git, shell, edits — all walled in

Allow-only, and fail-closed

Two design choices make Landlock trustworthy:

• Allow-only model. The policy lists the paths the process may use; everything not on the list is denied by default. You grant access, you don’t enumerate every forbidden thing.
• Fail-closed. If Landlock can’t be installed — the kernel doesn’t support it, the package won’t import, the policy won’t load — the launch refuses to start rather than running unrestrained. A missing wall is treated as a stop condition, not a warning. (The same posture protects the Morpheus drain daemon, which is opt-in via an environment flag and exits hard if the wall can’t go up.)

Division of labour with the gate

Landlock and the gate guard different territory, and the split is deliberate:

• System paths — /etc, other users’ files, anything outside the work area — are denied by Landlock at the kernel level. Blunt and absolute.
• The worktree itself is allowed by Landlock, because the agent legitimately needs to edit code there. The finer question of which in-repo files are sensitive — the protected paths — is handled by the gate at write time and the post-hoc sweep afterwards.

So Landlock draws the coarse outer boundary; the gate and the sweep do the fine-grained work inside it. Neither could do the other’s job well, which is why both exist.

See also

• The gate — the cooperative check Landlock backs up.
• Post-hoc sweep — the in-repo net Landlock leaves to others.
• Protected paths — the fine-grained in-repo rules.
• Morpheus drain — the daemon that installs Landlock at start.