All articles

Cybersecurity / 18 Sep 2026 / 7 min read

Landlock Adds a Process-Local Restriction Layer to Linux Access Control

A service may start with every filesystem permission granted to its Unix identity, yet only need a small subset after initialization. Changing the service account or mount topology can reduce that authority, but both are deployment-wide decisions. Linux Landlock provides a different boundary: a process can add restrictions to itself and its descendants without receiving privilege to grant new access. Landlock is a stackable Linux Security Module. Its rules are additional constraints, not replacements for discretionary access control, capabilities, or other active LSM policy. A Landlock rule cannot turn a denied operation into an allowed one. It can only remove authority that the process would otherwise possess.

Cybersecurity Linux

Cybersecurity / 18 Sep 2026 / 6 min read

io_uring Restrictions Freeze an Allowed Operation Surface Before Ring Activation

A service can expose an io_uring instance to code that should perform only a narrow class of asynchronous operations. The ring itself, however, supports many submission opcodes and registration commands. Relying only on application code to avoid unwanted operations leaves the allowed surface as a convention rather than a kernel-enforced property. Linux provides a tighter mechanism through IORING_REGISTER_RESTRICTIONS. A ring created with IORING_SETUP_R_DISABLED can receive a restriction set before it becomes usable for submissions. The process then enables the ring with IORING_REGISTER_ENABLE_RINGS. From that point, the kernel evaluates operations against the registered restrictions.

Cybersecurity Linux Security

Software Engineering / 18 Sep 2026 / 4 min read

io_uring Links Serialize Dependent Requests

Two adjacent io_uring submission queue entries are normally independent requests. Setting IOSQE_IO_LINK on the first changes that relationship: the next request does not start before the linked request completes. Repeating the flag forms an ordered chain inside one submission batch. The ordering property is narrower than global queue serialization. Requests outside the chain can still run independently, and separate chains can overlap. A link therefore expresses dependency between specific SQEs rather than imposing a barrier on the entire ring.

Software Engineering Linux

Cybersecurity / 18 Sep 2026 / 4 min read

Idmapped Mounts Remap File Ownership Without Rewriting Inodes

Idmapped Mounts Remap File Ownership Without Rewriting Inodes A container needs read-write access to a directory whose files carry host ownership values that do not line up with the container’s user namespace. Recursively changing ownership can make the directory usable, but it also mutates persistent inode metadata and can disrupt every other view of the same filesystem. Linux idmapped mounts provide a narrower mechanism: one mount can apply a different identity mapping while the stored ownership remains intact.

Cybersecurity Linux Security

Cybersecurity / 18 Sep 2026 / 7 min read

fs-verity Binds File Reads to a Merkle Tree Digest

A package manager can place an executable on a writable filesystem, close it, and later expect every byte returned from that file to match a previously approved object. Ordinary permissions can stop cooperative writers, but they do not turn file contents into a cryptographically identified object. Linux fs-verity supplies that narrower property for individual files: after verity is enabled, file data becomes read-only and reads are checked against a Merkle tree rooted in a stable file digest.

Cybersecurity Linux

Cybersecurity / 18 Sep 2026 / 6 min read

Fanotify Permission Events Put File Access Behind a Userspace Decision

A process calls execve() for a binary on a monitored filesystem, but the kernel does not immediately complete the execution open. A fanotify group has requested FAN_OPEN_EXEC_PERM, so the access waits while a userspace listener receives an event and returns FAN_ALLOW or FAN_DENY. The mechanism inserts a synchronous userspace decision into a filesystem operation that would otherwise proceed after ordinary kernel permission checks. That interception point is useful for policy engines that need information outside normal inode permissions, but it creates a distinct enforcement boundary. Availability now depends on a userspace responder, event coverage depends on the selected fanotify marks and event classes, and the mechanism does not convert every form of file use into a mediated operation.

Cybersecurity Linux

Software Engineering / 18 Sep 2026 / 4 min read

eventfd Turns Counter State into Descriptor Readiness

An eventfd descriptor becomes readable when its kernel-maintained counter is greater than zero. A write does not enqueue a variable-length message. It adds an unsigned 64-bit value to that counter, turning accumulated notification state into ordinary file-descriptor readiness. This boundary is useful in systems where a thread or kernel facility must wake an event loop without introducing a byte-stream protocol. The state carried by the descriptor is deliberately narrow: a counter, a readiness condition, and two possible consumption semantics.

Software Engineering Linux

Linux / 18 Sep 2026 / 5 min read

eventfd Aggregates Notifications in a Kernel Counter

An eventfd can absorb several notification writes before userspace services the descriptor. The kernel stores those writes in a 64-bit counter, so readiness represents pending counter state rather than a queue containing one record per notification. That distinction matters in event loops. A producer can add values while a consumer is occupied, and the next read can collapse accumulated state into one result. With EFD_SEMAPHORE, the same object exposes a different consumption rule without changing its readiness model.

Linux eventfd

Software Engineering / 18 Sep 2026 / 6 min read

EPOLLEXCLUSIVE Limits Wakeups Across Competing epoll Instances

EPOLLEXCLUSIVE changes which epoll waiters are awakened when several epoll instances monitor the same target. Without the flag, a readiness event can be delivered to every attached epoll instance. With exclusive registration, Linux can wake a smaller subset, reducing redundant scheduling in configurations that otherwise create a thundering herd. The flag changes wakeup distribution. It does not assign permanent ownership of the target descriptor, serialize I/O, or guarantee that exactly one application thread consumes each unit of work.

Software Engineering Linux

Linux / 18 Sep 2026 / 4 min read

EPOLLEXCLUSIVE Limits Wakeups Across Competing epoll Instances

A single ready socket can wake several threads when each thread waits on a different epoll instance that watches that socket. Linux provides EPOLLEXCLUSIVE to narrow that wakeup fan-out: among epoll instances that registered the target with the flag, a readiness event wakes one or more rather than all of them. The distinction is deliberately weaker than “exactly one waiter.” EPOLLEXCLUSIVE changes notification selection across epoll instances. It does not transfer ownership of the file descriptor, serialize all I/O, or guarantee that only one thread can observe useful work.

Linux epoll

Software Engineering / 18 Sep 2026 / 4 min read

CLOSE_RANGE_UNSHARE Isolates Descriptor Table Cleanup

A thread preparing to cross an execve() boundary can need to remove every file descriptor above a small preserved set while other threads still share its descriptor table. Closing descriptors one by one creates a race: another thread can allocate a descriptor into the interval while cleanup is in progress. Linux close_range() with CLOSE_RANGE_UNSHARE changes the table-sharing boundary before applying the range operation. This behavior matters because a file descriptor number is only an index into a process descriptor table. With CLONE_FILES, multiple tasks can refer to the same table, so a close performed through one task changes descriptor visibility for all tasks sharing it. CLOSE_RANGE_UNSHARE gives the calling task a private descriptor table as part of the operation.

Software Engineering Linux

Cybersecurity / 18 Sep 2026 / 6 min read

close_range Narrows File Descriptor Inheritance Before exec

A service process can accumulate sockets, pipes, directory handles, log files, and control descriptors long before it launches a helper. If those descriptors survive into the new program, the helper receives capabilities that its command-line arguments and environment do not reveal. A connected socket can carry authenticated access; an open directory can preserve reachability to a filesystem location; a pipe can expose another component’s data path. Linux close_range() gives pre-exec code a range operation over file descriptors. Its security value is not that descriptors become harmless. It is that a process can narrow the descriptor set that crosses an execve() boundary without enumerating /proc/self/fd or issuing one close() call per candidate descriptor.

Cybersecurity Linux Security

Linux / 18 Sep 2026 / 6 min read

close_range Controls Descriptor Inheritance Across exec Boundaries

A process preparing to call execve() may have hundreds or thousands of open file descriptors, while the new program should inherit only a small selected set. Closing descriptors one by one creates both bookkeeping cost and a concurrency problem: another thread can allocate a descriptor while the cleanup loop is still running. Linux close_range() moves that operation to the descriptor-table boundary. A caller specifies an inclusive numeric range and asks the kernel either to close descriptors in that range or mark them close-on-exec. With CLOSE_RANGE_UNSHARE, the caller can first detach its descriptor table from threads or processes that share it.

Linux System Calls

Tech / 17 Sep 2026 / 6 min read

Write Combining Merges Adjacent Stores Before Memory Traffic

Some memory regions are written far more often than they are read. Frame buffers, device apertures, and streaming output areas are common examples. Sending every small CPU store as a separate memory transaction can waste bus bandwidth and transaction overhead. Write combining gives the processor a temporary place to collect compatible stores. Several writes targeting nearby addresses can be merged into a larger transaction before they leave the CPU. The technique favors sustained write throughput, but it changes the timing and ordering properties that software can safely assume.

CPU Memory

Cybersecurity / 17 Sep 2026 / 5 min read

Userfaultfd Moves Page-Fault Resolution Into Userspace

Userfaultfd Moves Page-Fault Resolution Into Userspace A thread touches a registered virtual-memory page and stops before the access completes. Instead of resolving the fault entirely inside the kernel, Linux can report the event through a userfaultfd and let another userspace component decide when and with what content execution may continue. That design supports live migration, post-copy memory transfer, checkpointing, and related memory-management systems, but it also places a concurrency-sensitive decision point outside the faulting thread.

Cybersecurity Linux Security

Software Engineering / 17 Sep 2026 / 6 min read

userfaultfd Moves Missing-Page Resolution into User Space

A thread can touch a valid virtual address and stop before the access completes because the page has no present backing yet. With a range registered in UFFDIO_REGISTER_MODE_MISSING, Linux can report that fault through userfaultfd instead of resolving it entirely inside the kernel. A user-space manager then decides which page contents become visible before the blocked access resumes. This changes the ownership of one part of page-fault handling. The kernel still detects the fault, validates the virtual memory area, blocks the faulting execution, and installs mappings through the UFFDIO_* interface. User space gains control over the content and timing of resolution for registered faults.

Software Engineering Linux

Artificial Intelligence / 17 Sep 2026 / 6 min read

Use Selective Classification to Trade Coverage for Error Rate

A classifier usually returns a label for every input, even when its score distribution is nearly tied or the input sits far from familiar data. Selective classification changes that interface: the system may return a prediction or abstain. The acceptance rule then determines both how many inputs receive predictions and how often those accepted predictions are wrong. This is not the same as making the classifier intrinsically more accurate. Abstention moves some cases out of the automatic-decision set. Its value depends on whether the selection score ranks difficult cases well enough for rejected inputs to contain a disproportionate share of errors.

Artificial Intelligence Classification

Cybersecurity / 17 Sep 2026 / 7 min read

Unix Socket Peer Credentials Bind Identity to a Local Connection

Unix Socket Peer Credentials Bind Identity to a Local Connection A privileged local service often accepts requests from processes that share the same host but do not share the same authority. A pathname on a Unix domain socket can control who reaches the listener, yet a successful connection does not by itself tell the service which process is on the other end. Linux provides a second boundary: SO_PEERCRED lets a connected Unix socket expose peer credentials supplied by the kernel.

Cybersecurity Linux

Linux / 17 Sep 2026 / 4 min read

Truncating a Mapped File Can Trigger SIGBUS

A process can retain a valid mmap() address range after another operation shrinks the backing file, then receive SIGBUS when it touches a mapped page past the file’s new end. The mapping itself has not vanished. Its backing object no longer covers every page that the virtual mapping originally referenced. This boundary is easy to miss because mapping lifetime and file size are separate state. Closing the original file descriptor does not invalidate an established mapping, and shrinking the file does not act like munmap() on every process that maps it.

Linux mmap

Cybersecurity / 17 Sep 2026 / 7 min read

TLS Must-Staple Turns Missing OCSP Evidence Into Handshake Failure

TLS Must-Staple Turns Missing OCSP Evidence Into Handshake Failure A TLS server can hold a valid private key and present a certificate that chains to a trusted root while its revocation evidence is unavailable. Ordinary OCSP stapling does not necessarily turn that absence into failure: a client can request status information, yet the server is permitted to omit a response in the base stapling protocol. That optionality creates a security boundary. An active intermediary that can suppress access to an OCSP responder can exploit client policies that accept an inconclusive revocation check. The TLS Feature extension defined by RFC 7633 changes the certificate itself so that selected TLS features become conditions of acceptable use. For OCSP stapling, the certificate can assert that a conforming client must receive the requested status evidence.

Cybersecurity TLS

Cybersecurity / 17 Sep 2026 / 6 min read

TLS 1.3 Early Data Trades a Round Trip for Replay Exposure

TLS 1.3 Early Data Trades a Round Trip for Replay Exposure A returning TLS 1.3 client can possess a resumption ticket and application data ready to send before a new handshake has finished. Early data, commonly called 0-RTT data, permits those bytes to travel in the client’s first flight. The latency benefit changes a security property at exactly the point where an application may be tempted to act: early data does not carry the same replay protection as ordinary post-handshake application data.

Cybersecurity TLS 1.3

Software Engineering / 17 Sep 2026 / 4 min read

timerfd Counts Expirations Through Descriptor Reads

A periodic timerfd can expire several times before user space reads it. The next successful read() does not report only the most recent tick: it returns an unsigned 64-bit count of expirations accumulated since the previous successful read, or since the timer was configured if no read has completed yet. That behavior makes a timer an event-loop object without converting each expiration into a signal. The descriptor becomes readable when at least one expiration is pending, and the same descriptor can participate in poll(), select(), or epoll() beside sockets, pipes, and other descriptor-backed event sources.

Software Engineering Linux

Artificial Intelligence / 17 Sep 2026 / 6 min read

Teacher Forcing Creates a Prefix Distribution Gap

Autoregressive models predict the next token from a prefix. During teacher-forced training, that prefix usually comes from the reference sequence. During generation, it contains tokens emitted by the model itself. A prediction error can therefore change the context used for every later prediction. This difference is often called exposure bias. The useful engineering detail is more specific: training and generation can present different prefix distributions to the same conditional predictor. Token-level validation on clean reference prefixes does not fully characterize behavior after the model enters a prefix that its training data rarely presented.

Artificial Intelligence Language Models

Linux / 17 Sep 2026 / 5 min read

TCP_NODELAY Disables Nagle Coalescing on a Socket

A TCP socket can hold a small write instead of transmitting it immediately when earlier data remains unacknowledged. This behavior comes from Nagle coalescing: it limits the stream of small TCP segments by allowing outstanding data to influence transmission of newly queued bytes. On Linux, setting TCP_NODELAY disables that coalescing rule for the socket. Small writes become eligible for prompt transmission, subject to the rest of the TCP stack, congestion control, flow control, queue state, and device scheduling.

Linux TCP