$ whoami
Old UNIX greybeard, FreeBSD-or-nothing, been online since Usenet. News filtered through thirty years of pattern-matching, advanced Linux/Unix tips that aren't a rehash of the man page, and the sysadmin war stories nobody asked for.
Linux 7.3 releases today with a fix for the small direct I/O bottleneck on Gen5 NVMe that was capping throughput at roughly half the drive's rated speed. Btrfs gets 3x to 5x wins in several paths. EXT4 loosens an overly conservative lock. Apple M3 Pro and Max land in the tree.
Let's Encrypt ran on schedule, certbot said success, and the cert on disk was valid. nginx served the expired one anyway. Ninety days of silent post-hook failures, caught only when everything stopped working.
Once mseal(2) returns, no mprotect, no munmap, no MAP_FIXED remap touches that range again. Chrome seals its JIT code pages. glibc 2.41 seals its internal control structures. The syscall landed in Linux 6.10; if you are writing a JIT engine, a sandbox, or anything that maps then hardens executable memory, you want this.
The day’s tech news, and what it actually means if you run the machines.
Syscalls, kernel knobs, tracing, ZFS and jails. Commands you can run tonight.
War stories, production fuckups and design rants. The long ones.
Pick the part of the stack that's misbehaving. Every hub starts with a numbered reading order, then the syscalls underneath it, then every Tale and MOTD that touches it.
| Interface | Since |
|---|---|
| mseal(2)Permanently seal a virtual memory area against mprotect, munmap, and MAP_FIXED remapping. | 6.10 |
| cachestat(2)Query page cache status (resident, dirty, writeback, evicted) for a byte range of an open file. | 6.5 |
| memfd_secret(2)Create memory removed from the kernel's direct map, mapped only by fd holders. | 5.14 |
| landlock_create_ruleset(2)Create a Landlock ruleset fd, step one of unprivileged filesystem/network sandboxing. | 5.13 |
| mount_setattr(2)Change VFS-layer mount attributes on an existing mount or subtree, optionally recursing. | 5.12 |
| process_madvise(2)madvise() for another process's address space, addressed by pidfd and an iovec of ranges. | 5.10 |
| close_range(2)Close, or mark close-on-exec, every file descriptor in a range in one call. | 5.9 |
| openat2(2)Open a file with kernel-enforced path-resolution constraints (RESOLVE_* flags). | 5.6 |
46 cards: when each interface landed, whether glibc wraps it, the flags and errno worth knowing, and what the BSDs did instead. Every version comes from the man page cited on the card.
→ Kernel check
Paste uname -sr and see what that box can actually call.
RodHat2026-07-18 – 2026-10-18