Topic
Kernel & Security
Kernel changes, operating-system security, vulnerabilities, hardening, and the tradeoffs behind them.
Six years of WireGuard in the Linux kernel. I was wrong to be skeptical.
WireGuard landed in Linux 5.6 in April 2020. Six years later, it's in every major OS, every cloud provider's toolbox, and the cryptography audit held. The 4,000-line kernel module that was supposed to be too opinionated turned out to be the right kind of opinionated.
Your process doesn't need 400 syscalls. seccomp-BPF lets you say so.
seccomp-BPF loads a classic BPF filter into the kernel that runs on every syscall your process makes. Give it a whitelist, everything else gets EPERM or SIGKILL. Here's how the filter model works, how libseccomp makes it tolerable, and how to audit what a real binary actually needs.
iptables is a shim now. The shim has edge cases. Rewrite your rules.
Debian 13 Trixie completed the transition — iptables the binary now calls the nftables backend across every major Linux distro. The legacy xt_* kernel path still exists, but it's not the default and it's on the removal list. Twelve years after nftables landed, the ecosystem caught up.
ftrace has been on your machine since 2.6.27. Here's how to actually use it.
ftrace is Linux's built-in kernel function tracer, accessible directly via /sys/kernel/debug/tracing/. No compiler, no LLVM, no kernel headers — write to files, read call graphs. Here's the workflow for function tracing, call-graph timing, IRQ latency, and isolated trace instances.
`sudo` wrote its last heap overflow in C. The Rust rewrite shipped.
sudo-rs is production-ready for most deployments. A setuid-root binary sitting at uid 0, accumulating privilege-escalation CVEs for four decades, is exactly the right target for a memory-safe rewrite. This one is hard to argue with.
`getrandom()` skips the kernel now. Took long enough.
Linux 6.11 shipped vDSO support for getrandom(). Every TLS handshake, UUID, and ephemeral key in your system is now getting random bytes from userspace without a syscall trap. The syscall was added in 2014. The optimization arrived a decade later. The implementation is correct. Both things are true.
The OOM killer was doing its job
A slow memory leak ran undetected for five weeks because the kernel's out-of-memory killer, executing its heuristic correctly, kept choosing the monitoring agent over the leaking service. The pager never fired. The monitoring gaps were there in the data the whole time.
ps lies about memory. /proc/smaps_rollup does not.
RSS from ps aux double-counts shared pages and makes every process look more expensive than it is. PSS from /proc/PID/smaps_rollup gives you actual per-process memory ownership. Here is how to read it.
ss -i shows you what netstat never could: TCP internals live
Everyone knows ss -tulnp. Almost nobody uses ss -i, which surfaces congestion window size, RTT, retransmit counts, and send/receive buffer fill — directly from the kernel, no tool required.
nohup, disown, setsid: what each actually does and which one you want
Three tools for keeping a process alive after you close the terminal. They do not do the same thing. Here is the kernel-level difference, and when each one applies.
Linux 7.2 ships. The AI noise finally cleared the kernel's basement.
Linux 7.2 stable lands today with cache-aware scheduling, MGLRU gains that doubled MongoDB throughput in benchmarks, and a pile of driver removals nobody asked for — except the LLMs, who wouldn't stop filing bugs about them.
bpftrace gives Linux what FreeBSD had in 2005. The one-liners are worth the wait.
dtrace showed up on Solaris in 2004, shipped in FreeBSD 7 in 2008, and Linux users spent the next decade pretending strace was sufficient. bpftrace is the real answer — dynamic kernel tracing, histograms, stack walks, zero overhead when idle.
FreeBSD 16 evicted the last GPL tenant from base. The kernel has thoughts.
FreeBSD replaced dialog with bsddialog and declared its base system GPL-free. Then someone looked at the kernel. Thirty years of license hygiene, and it ends with "oops, still some in there."
Your kernel ships a CPU profiler. perf(1) is the key.
perf stat hands you hardware performance counters — cycles, cache misses, branch mispredictions — in seconds. perf record samples call stacks at full speed. Both are already installed and beat any SaaS APM for understanding CPU-bound problems.
Your container is six clone(2) flags. nsenter gets you back in.
Containers are six kernel namespaces and nothing else. nsenter gets you inside from the host without docker exec, without touching the image, and without whatever tooling the vendor decided to ship.
Rust in the Linux kernel is not failing. I need to update my priors.
When Linus merged Rust support in 6.1, I gave it eighteen months before the borrow-checker arguments turned into flame wars and the whole experiment got ripped out. Real drivers are shipping. I was wrong about the trajectory.
pledge() turns 10. Linux still doesn't have anything half as clean.
OpenBSD's pledge(2) landed in 5.9 in 2016. Ten years later, Linux has Landlock (good) and seccomp-bpf (powerful and painful) and still nothing that lets a process sandbox itself in a single readable line. RodHat on why API simplicity is a security property.
systemd wants to replace sudo. I hate that they're not wrong about why.
run0 has been in systemd 256+ for over two years now and distros are starting to actually ship it. The scope creep argument is real. The security critique of sudo is also real. Holding both is annoying.
Unprivileged eBPF is getting locked out by default. It's five years overdue.
The Linux kernel project is landing a config change that makes kernel.unprivileged_bpf_disabled permanent by default. RodHat on why unprivileged BPF was always an attack surface in a trenchcoat, and why your bpftrace workflow is fine.
Upgrade like you can undo it, because with bectl you can
A ZFS boot environment is a bootable clone of your root dataset. Make one before every upgrade and a wrecked kernel becomes a reboot, not a recovery-media evening. The bectl walk, and the loader trick that saves you when the new one won't boot.
The scary FreeBSD advisory this week isn't an RCE — it's a privilege check that slipped
FreeBSD-SA-26:53.ktrace is a regression in how ktrace is gated inside jails. No dramatic exploit, just an isolation boundary that quietly stopped meaning what you thought it meant.
"We'll just stay on LTS" stopped being a strategy when LTS became two years
Linux kernel long-term support dropped from six years to two, and the reason given was honest: almost nobody was testing the old branches. Stability was never a property of the version number. It was a property of somebody doing the work.
io_uring keeps producing the same class of CVE and it's time to call that structural
Another batch of privilege-escalation bugs in io_uring dropped this week. RodHat explains why the design keeps generating the same vuln class, and what to actually do about it in your container environments.
OpenSSH is finally done pretending your 2009 SSH config was acceptable
The OpenSSH project continues ripping out legacy cryptography — DSA keys gone, SHA-1 gone, post-quantum key exchange on by default. RodHat runs through what breaks and what you should have burned years ago anyway.
CISA wants a body count on your malloc() calls. They're not entirely wrong.
Federal agencies are now demanding memory-safety roadmaps from software vendors. RodHat runs through what the mandate gets right, what it gets delusional, and what happens when bureaucrats discover that C is load-bearing.
Another wave of typosquat packages hit a major registry, and the fix everyone proposes still won't ship
The same typosquatting attack pattern, the same registry, the same 'we should really fix this' thread. RodHat's seen this loop enough times to name it.
Everything is a critical CVE now, which means nothing is
CVSS score inflation has gotten bad enough that a 9.8 barely raises RodHat's eyebrow anymore. That's the actual crisis.
Get a real disk latency histogram in one line of bpftrace
iostat gives you an average, and averages hide the tail that's actually hurting you. A four-line bpftrace program prints a log2 histogram of block I/O latency per device, live, on a production box, with no agent and no restart.
The hard part of Rust in the kernel was never the Rust
The compiler works. The bindings work. The drivers work. What nearly stalled the whole effort was thirty years of maintainer culture meeting a rule about who has to maintain what — and that's a governance problem no language solves.
Find out which syscall is actually eating your latency with one dtrace one-liner
A real dtrace/bpftrace one-liner for finding the syscall responsible for tail latency, plus why strace -T won't get you there.
Charging extra for SSO is charging extra for not getting breached
Single sign-on sits behind the enterprise tier at a suspicious number of vendors, at a markup that has nothing to do with what it costs to implement. It's not a feature. It's the control you need to offboard someone the day you fire them.