Saved in:
| Main Authors: | , , , , , , |
|---|---|
| Format: | Preprint |
| Published: |
2025
|
| Subjects: | |
| Online Access: | https://arxiv.org/abs/2509.18548 |
| Tags: |
Add Tag
No Tags, Be the first to tag this record!
|
| _version_ | 1866916059886387200 |
|---|---|
| author | Brandt, Steven R Morris, Max Diehl, Patrick Bowen, Christopher Tucker, Jacob Bristol, Lauren Richard III, Golden G. |
| author_facet | Brandt, Steven R Morris, Max Diehl, Patrick Bowen, Christopher Tucker, Jacob Bristol, Lauren Richard III, Golden G. |
| contents | The most recent Linux kernels have a new feature for securing applications: Landlock. Like Seccomp before it, Landlock makes it possible for a running process to give up access to resources. For applications running as Science Gateways, network access is required while starting up MPI, but for the sake of security, it should be taken away prior to the reading of user-supplied parameter files. We explore the usefulness of Landlock by modifying and locking down three mature scientific codes: The Einstein Toolkit (a code that studies the dynamics of relativistic astrophysics, e.g. neutron star collisions), Octo-Tiger (a code for studying the dynamics of non-relativistic astrophysics, e.g. white dwarfs), and FUKA (an initial data solver for relativistic codes). Finally, we implement a fully-functioning FUKA science gateway that relies on Landlock (instead of user authentication) for security. |
| format | Preprint |
| id |
arxiv_https___arxiv_org_abs_2509_18548 |
| institution | arXiv |
| publishDate | 2025 |
| record_format | arxiv |
| spellingShingle | Locking Down Science Gateways with Landlock and Seccomp Brandt, Steven R Morris, Max Diehl, Patrick Bowen, Christopher Tucker, Jacob Bristol, Lauren Richard III, Golden G. Software Engineering The most recent Linux kernels have a new feature for securing applications: Landlock. Like Seccomp before it, Landlock makes it possible for a running process to give up access to resources. For applications running as Science Gateways, network access is required while starting up MPI, but for the sake of security, it should be taken away prior to the reading of user-supplied parameter files. We explore the usefulness of Landlock by modifying and locking down three mature scientific codes: The Einstein Toolkit (a code that studies the dynamics of relativistic astrophysics, e.g. neutron star collisions), Octo-Tiger (a code for studying the dynamics of non-relativistic astrophysics, e.g. white dwarfs), and FUKA (an initial data solver for relativistic codes). Finally, we implement a fully-functioning FUKA science gateway that relies on Landlock (instead of user authentication) for security. |
| title | Locking Down Science Gateways with Landlock and Seccomp |
| topic | Software Engineering |
| url | https://arxiv.org/abs/2509.18548 |