Kernel

🤔 What’s a syscall, anyway? Image credits: Mike Norris via Pexels Every time your program reads a file, writes to a socket, or allocates memory, at some point it has to ask the kernel to actually do it. That ask is a syscall, the narrow, well defined boundary where userspace code crosses into the kernel. write(), read(), open(), mmap(), these aren’t just library functions, they’re the entire vocabulary your program has for talking to the outside world. Everything else, fwrite, Python’s file.write(), std::fs::File, is just a wrapper around this same handful of kernel entry points. ...

👋 Intro If you have ever spent time hardening Linux applications, you probably know the frustration of the all-or-nothing permission model. In the standard Linux environment, once a process starts running, it usually has far more filesystem access than it actually needs. While we have tools like seccomp, chroot, or heavy-duty modules like SELinux and AppArmor, they often feel too complex for simple, application-level sandboxing. Landlock changes this. Since its merge into the Linux kernel in version 5.13, it has become a game-changer for developers. It allows a process to restrict itself without requiring root privileges, moving security away from global system policies and directly into your application code. ...

👻 Intro While our previous post focused on the core components of LTP tests, today in this part boo two we’re taking a spooky deep dive into the options available in struct tst_test 🦇. The Linux Test Project (LTP) began as a collaborative effort between SGI, OSDL, and Bull. Today, it lives with the joint contributions of industry leaders including IBM, Cisco, Fujitsu, SUSE, Red Hat, Oracle, and others. Its mission remains clear: providing the open source community with comprehensive tests that verify Linux’s reliability, robustness, and stability. 🕸️ ...

👣 Intro Tracing tools are pretty popular in the Unix/Linux ecosystem; for example in the userspace we have ltrace to trace library calls of the programs and strace to dive in deeper and inspect syscall usage. One of the many features that Linux kernel offers since 2008 (then evolved) is ftrace that allows many different kind of tracing at runtime. While not as flexible as eBPF technology, it can be helpful in some occasion and doesn’t require a full fledged programming language. ...