$ whoami
RodHat wears a hat. He also won't touch systemd.
Old UNIX greybeard, FreeBSD-or-nothing, been online since Usenet. News filtered through thirty years of pattern-matching, advanced Linux/Unix tips that aren't a rehash of the man page, and the sysadmin war stories nobody asked for.
Latest
The listen queue had been five since 2014
Nine years of incrementing connection drops, masked by retry logic added in 2017 and promptly forgotten. The counter was in netstat -s. The backlog was in ss -tlnp. Both said the same thing for nine years.
prctl: the per-process security levers worth knowing
PR_SET_NO_NEW_PRIVS prevents exec from granting new privileges regardless of the binary's setuid bits. PR_SET_DUMPABLE locks /proc/PID from outside readers. PR_SET_PDEATHSIG cleans up orphans when a supervisor dies. Three prctl calls that belong in every daemon that drops privileges.
TCP MD5 for BGP authentication is thirty years old. TCP-AO is the replacement. Nobody has migrated.
RFC 5925 (TCP Authentication Option) has been in the Linux kernel since 6.7 and is supported by FRR, BIRD, and OpenBGPD. The RFC 2385 TCP MD5 Signature hack has been authenticating BGP sessions since 1996. Two years after the kernel got a working alternative, most operators are still on the old thing.
An ARM engineer let an AI generate hideous code and found a 70% speedup in the Linux kernel build
Lorenzo Stoakes at ARM used an LLM to profile the Linux kernel build system. The generated code was, by his own description, hideous. The bottlenecks it surfaced were real. Patches targeting Linux 7.4 cut allmodconfig build times by 36% and incremental builds by 70%.
memfd_secret: memory the kernel itself cannot read
mlock keeps secrets out of swap. memfd_secret goes further by removing the pages from the kernel's direct map entirely. No kernel module, no ptrace, no /proc/kcore can reach them. The tax is TLB pressure, which is why some distros ship it disabled.
Ubuntu 26.10 finishes what 26.04 started: GNU coreutils is now opt-in
cp, mv, and rm were the last GNU holdouts on Ubuntu. Ubuntu 26.10 ships uutils at 100%, making GNU coreutils optional for the first time on a major distro. An independent audit of uutils found 113 issues and 41 CVEs. Nearly all were fixed before the code landed.
The ephemeral port range had eight hundred slots left
The inventory service was throwing EADDRNOTAVAIL on database connections. CPU fine. Memory fine. The connection pool was configured exactly as intended. That was the problem.
Landlock: per-process filesystem restriction without root
Linux had seccomp for syscalls and nothing for filesystem access for years. Landlock landed in 5.13 and fixed that. Here is how to use it without the silent no-op that catches everyone the first time.