FailFS in Linux 7.3 strips sandboxes of the filesystem: every call returns EOPNOTSUPP

Sandboxing a Linux process usually means a long session of setting restrictions: mount namespaces, bind-mounts, chroot, and other mechanisms that hide most of the filesystem. The new kernel offers a radically different approach — simply take the filesystem away entirely.

That is the idea behind FailFS, a tiny pseudo-filesystem expected to land in Linux 7.3. Its entire job boils down to one thing: every operation that reaches FailFS returns EOPNOTSUPP, meaning "operation not supported." This is not a bug — it is the design. The filesystem is deliberately useless.

The key effect shows up when FailFS is set as the root or working directory of a process. Normal pathname lookup effectively stops working: absolute paths, absolute symlinks, and relative paths through the current directory all fail. An attempt to open /etc/passwd gets nowhere, because there is no useful /etc to find.

Instead, the process must start any filesystem operation from an explicitly provided file descriptor. A sandbox manager could open a directory, hand that descriptor to the application, and the application could access files beneath it using calls like openat(). Anything not reachable from those deliberately supplied descriptors might as well not exist.

This flips the security model: instead of "not this, not that, not the other," the system starts from nothing and hands the program exactly the pieces it needs. Interesting consequences follow. For one, placing a process entirely inside FailFS prevents it from running ordinary dynamically linked executables: ELF binaries specify their dynamic loader via an absolute path like /lib64/ld-linux-x86-64.so.2, and absolute paths do not work in FailFS.

FailFS also has a sibling called NULLFS, introduced earlier. It is another deliberately useless filesystem, but it behaves differently: it contains a permanently empty directory, and failed lookups return ENOENT, as if the requested file simply does not exist. NULLFS was created as an immutable bottom layer beneath the real root filesystem, to make operations like pivot_root() cleaner.

Neither FailFS nor NULLFS replaces the rest of what a secure sandbox needs, but they offer an unexpected starting point: instead of building complex access rules, begin with nothing and add only what is necessary.