Bug 13645

During testing Suricata 7 I can confirm that enabling Landlock Support with obviously incorrect data results in Suricata running just fine.

It seems that the kernel has this not enabled:

> [root@fw01 ipfire-2.x]# cat /sys/kernel/security/lockdown
> [none] integrity confidentiality

However, changing this to "integrity" does not seem to change anything:

> [root@fw01 ipfire-2.x]# cat /sys/kernel/security/lockdown
> none [integrity] confidentiality

We have various kernel options that seem like the enable Landlock by default. However that does not seem to be the case at all.

Please investigate if this intended behaviour. If so, we might not need to compile Landlock.

If we want to enable this by default, we will have to identify all services that might use this to prevent that we break anything when rolling out a kernel with Landlock enabled.