Mandatory access control

Landlock confines a process from inside, with no root and no global policy

Landlock has been in mainline Linux since 5.13 and asks no administrator for permission. The dev.to walkthrough that demonstrates it prints a read-only rule under a goal that requires writing.