Mickaël Salaün is a security researcher, software developer and open source enthusiast. He is mostly interested in Linux-based operating systems, especially from a security point of view. He has built security sandboxes (e.g. StemJail) before hacking into the kernel on a new LSM called Landlock. He is currently employed by the French Network and Information Security Agency (ANSSI).



Programmatic access control implemented as a Linux Security Module

Landlock is a Linux Security Module (LSM) that makes it possible to create security sandboxes. This kind of sandbox is expected to help mitigate the security impact of bugs or unexpected/malicious behaviors in user-space applications. Landlock is inspired by seccomp-bpf but instead of filtering syscalls and their raw arguments, a Landlock rule can inspect the use of kernel objects like files and hence make a decision according to the kernel semantic.


Dynamic sandboxer (only) using Linux user namespaces

StemJail is a proof of concept to isolate groups of processes pertaining to the same activity into an environment exposing only the relevant subset of user data. Dynamic activity discovery allows seamless integration into the user workflow. Moreover, StemJail is designed to run without intrusive changes to the system and to be configured and used by any unprivileged user thanks to the Linux user namespaces. Last but not least, StemJail is developed in Rust to help prevent a wide range of recurring security vulnerabilities, without performance compromise.

Linux kernel contributions

Miscellaneous features and fixes

Touching subsystems like seccomp, User-mode Linux, BPF, LSM and grsecurity. Some patches may be in flight.

grsecurity/PaX archives

grsecurity's Git repository (reconstruction)

grsecurity is the most advanced Linux kernel hardening patchset. This repository, not affiliated with the upstream project, aggregate most public grsecurity patches applied to consistent Linux source trees. The raw grsecurity patches, PaX patches and combined VServer + grsecurity patches are also available with their associated changelogs.


Proof of concept of a Xen covert channel

This cover channel exploit the mechanism used by the Xen hypervisor to share the host's memory with virtual machines. The proof of concept is a Linux driver which creates a device /dev/xencc enabling user space from one guest to communication with another guest.