$ whoami
RodHat wears a hat. He also won't touch systemd.
Old UNIX greybeard, FreeBSD-or-nothing, been online since Usenet. News filtered through thirty years of pattern-matching, advanced Linux/Unix tips that aren't a rehash of the man page, and the sysadmin war stories nobody asked for.
Latest
GCC 14 has -fhardened. Stop writing out those nine flags by hand.
GCC 14 added -fhardened, a single compiler flag that bundles the full standard stack of binary hardening options. FORTIFY_SOURCE, stack protection, PIE, RELRO, control-flow integrity, auto-initialization. The flags you have been copying from a Makefile snippet since 2013.
mseal() landed in Linux 6.10. Browsers wanted it. You can use it too.
Linux 6.10 added mseal(), a syscall that permanently seals virtual memory regions against remapping, permission changes, and unmapping. The browser vendors pushed for it after decades of losing the same exploit race. Here is how it works and when you would use it directly.
BBRv3 is in the kernel. CUBIC is still the default. Here is when to care.
TCP BBR version 3 fixed the fairness problem that made BBRv1 a bad neighbor on shared paths. It is in the Linux kernel. The sysctl to switch is one line. The question is whether switching is actually the right call for your workload.
MADV_FREE and the RSS number that's lying to you
Since jemalloc 4.x, freed memory goes back to the OS with MADV_FREE instead of MADV_DONTNEED. Pages stay mapped, RSS stays inflated, and your monitoring is reading the wrong number. The fix is in /proc/pid/smaps_rollup.
mold links Chromium in two seconds. Your build chain is still waiting on the linker.
The linker has been the serialized last step in the build chain for thirty years. mold rewrote it for parallel hardware. Here is what it does differently, when the numbers matter, and when to leave well enough alone.
The service was healthy and accepting no new connections
Seven hundred clients got connection refused. Health checks passed. Metrics reported normal. The process had opened one thousand and twenty-two file descriptors and the system limit was one thousand and twenty-four.
The eBPF verifier is 30,000 lines of C, and it has the privilege-escalation CVEs to show for it
eBPF runs in the Linux kernel. The verifier that is supposed to make user-submitted programs safe is one of the largest, most complex files in the kernel tree, and every production distribution has disabled unprivileged BPF access. Here is the state of the restriction and why it exists.
pidfd: process file descriptors and the PID recycling race
Every kill(pid, sig) call has a race condition. The PID can be recycled between when you checked it and when you send the signal. Linux 5.2 shipped pidfd to fix this. Here is the actual API.