iiinova — where your digital self keeps evolving

Mickaël Salaün @l0kod.bsky.social · 09/10/2026

We gave a talk summarizing the #Landlock changes over the last two years, and what's coming next: Observability, process-wide control, networking and more... lsseu2026.sched.com/event/2QmU9 Don't miss the lltop demo recording!

lsseu2026.sched.com

000

Mickaël Salaün @l0kod.bsky.social · 25/08/2026

10 years ago, I sent an initial version of #Landlock: lore.kernel.org/all/14721211... The design evolved significantly from the initial RFC to extend seccomp, through this eBPF version, to the final one in 2021, simplified and tailored for unprivileged sandboxing: landlock.io

000

Mickaël Salaün @l0kod.bsky.social · 01/02/2026

I gave a talk at #FOSDEM about Island: Sandboxing tool powered by #Landlock fosdem.org/2026/schedul...

fosdem.org

FOSDEM 2026 - Island: Sandboxing tool powered by Landlock

021

Mickaël Salaün @l0kod.bsky.social · 05/12/2025

Just released Island 🏝️, a sandboxing tool powered by #Landlock. It auto‑confines processes according to the caller's context (e.g. CWD) and comes with slick Zsh integration, so you can use your terminal naturally without command prefixes. Feedback welcome! github.com/landlock-lsm...

github.com

GitHub - landlock-lsm/island: Sandboxing tool powered by Landlock

Sandboxing tool powered by Landlock. Contribute to landlock-lsm/island development by creating an account on GitHub.

041

Mickaël Salaün @l0kod.bsky.social · 29/08/2025

I gave a (second) talk at #linuxsecuritysummit on a new configuration format, #Landlock Config, designed to define sandboxing security policies in JSON or TOML. lsseu2025.sched.com/event/25GET You can easily try it: github.com/landlock-lsm... Feedback welcome!

000

Mickaël Salaün @l0kod.bsky.social · 29/08/2025

Script integrity: I gave a talk at #linuxsecuritysummit in Amsterdam on the latest news about Linux's AT_EXECVE_CHECK, useful to check the full file executability (including LSMs' policies), and the two new secbits to really control executable code. lsseu2025.sched.com/event/25GEQ

lsseu2025.sched.com

Linux Security Summit Europe 2025: Script Integrity - Mickaël Salaün, Micro...

View more about this event at Linux Security Summit Europe 2025

011

Mickaël Salaün @l0kod.bsky.social · 15/08/2025

AI agents can potentially gain extensive access to user data, and even write or execute arbitrary code. OpenAI Codex CLI uses #Landlock sandboxing to reduce the risk of buggy or malicious commands: github.com/openai/codex...

OpenAI Codex CLI leveraging Landlock sandboxing

001

Mickaël Salaün @l0kod.bsky.social · 19/05/2025

I just published the fifth #Landlock newsletter! 🤓 - new kernel features: IPC scoping and audit logs - kernel fixes - library and talk updates - new doc - new open source Landlock users - RHEL support lore.kernel.org/landlock/202...

031

Mickaël Salaün @l0kod.bsky.social · 29/04/2025

I released a new version of the #Landlock crate: github.com/landlock-lsm... We can now easily restrict signal sending and connections to abstract UNIX sockets for #rustlang programs.

github.com

010

Mickaël Salaün @l0kod.bsky.social · 26/03/2025

Starting with Linux 6.14, we'll be able to securely control script execution thanks to new syscall flags, successors of O_MAYEXEC. This is crucial to fully support code integrity. The next step is to enlighten script interpreters. Let me know if you want to help! docs.kernel.org/userspace-ap...

docs.kernel.org

Executability check — The Linux Kernel documentation

010

Reposted by Mickaël Salaün

Gergely Orosz @gergely.pragmaticengineer.com · 20/03/2025

"Most people don’t understand how Linux deals with 4,000+ devs from 500+ companies a year with only email, git and no project managers." When Greg Kroah-Hartman (a Linux Foundation fellow) wrote this to me, I also did not understand, for obvious reasons. I asked him to explain, and he did:

211712

Reposted by Mickaël Salaün

Christian Brauner @cbrauner.bsky.social · 16/12/2024

I've written a post that shows how to list all mounts in all mount namespaces (all mounts on the system) using new apis we added to the #vfs last year. brauner.io/2024/12/16/l... #kernel #linux #vfs

brauner.io

Listing all mounts in all mount namespaces

Introduction

063

Mickaël Salaün @l0kod.bsky.social · 16/12/2024

I'll give a talk at #FOSDEM: #Sandbox IDs with #Landlock We'll talk about the challenges to identify sandboxed processes in a safe and unprivileged way, and how that could be used to identify #containers. fosdem.org/2025/schedul... #FOSDEM2025 #container

fosdem.org

FOSDEM 2025 - Sandbox IDs with Landlock

140