# POSIX POSIX is a standard operating system interface and environment, including a shell and common utility programs, designed to support source-code portability for applications. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Libreboot Build System Audit 6 DevFeed: [Libreboot Build System Audit 6]() Original publisher: [Read original article]() Author: Leah Rowe Published: 2026-09-17T04:32:50.666044Z Content type: article Language: en Sources: [News about Libreboot releases and development]() Topics: [audit](), [POSIX](), [Shell](), [Code](), [releases]() Tags: [audit](), [bios](), [build-system](), [canoeboot](), [code](), [coreboot](), [free-software](), [libre](), [libreboot](), [opensource](), [release](), [return](), [shell](), [uefi]() ### AI overview This article reports on the sixth audit of Libreboot's lbmk build system. It describes code cleanup, bug fixes, feature changes, and a reduction from 1,482 to 1,109 lines of shell script, a 25% decrease, between the Libreboot 20240612 release and the 19 July 2024 revision. ### Source excerpt Article: Libreboot Build System Audit 6 Web link: https://libreboot.org/news/audit6.html ## Libreboot Build System Audit 5 DevFeed: [Libreboot Build System Audit 5]() Original publisher: [Read original article]() Author: Leah Rowe Published: 2026-09-17T04:32:50.666044Z Content type: article Language: en Sources: [News about Libreboot releases and development]() Topics: [audit](), [opensource](), [boot](), [POSIX](), [ide](), [systems]() Tags: [audit](), [bios](), [bugs](), [canoeboot](), [clean-code](), [coreboot](), [efficiency](), [firmware](), [free-software](), [libre](), [libreboot](), [linux](), [opensource](), [operating-systems](), [posix](), [uefi]() ### AI overview This article describes the fifth audit of Libreboot's lbmk build system, covering changes made since the Libreboot 20240504 release. It reports a reduction in shell-script size, bug fixes, feature changes, and improvements aimed at cleaner and more efficient code. ### Source excerpt Article: Libreboot Build System Audit 5 Web link: https://libreboot.org/news/audit5.html ## Sound Open Firmware 2.15 Released With AMD ACP 7.x Support, Intel UAOL DevFeed: [Sound Open Firmware 2.15 Released With AMD ACP 7.x Support, Intel UAOL]() Original publisher: [Read original article]() Author: Michael Larabel Published: 2026-09-15T13:04:40Z Content type: release Language: en Sources: [Phoronix]() Topics: [Embedded Software Dev](), [Open Source](), [intel](), [Security](), [qemu](), [Xtensa](), [Fuzzing/Fuzz testing](), [POSIX](), [Testing]() Tags: [desktop-linux](), [driver](), [dsp](), [firmware](), [fuzzing](), [intel](), [linux-benchmarking](), [linux-hardware-benchmarks](), [linux-hardware-reviews](), [linux-how-to](), [linux-performance](), [linux-server-benchmarks](), [open](), [open-source-graphics](), [phoronix](), [phoronix-test-suite](), [posix](), [processor](), [qemu](), [security](), [testing](), [ubuntu-benchmarks](), [ubuntu-hardware](), [usb](), [xtensa]() ### AI overview Sound Open Firmware 2.15 adds user-space, memory-protected module execution, AMD ACP 7.x and NXP i.MX8MP support, Intel UAOL USB audio offload, testing targets, security hardening, and new audio processing modules. ### Source excerpt Sound Open Firmware as the open-source, vendor-independent audio DSP firmware stack and driver framework is out today with a new feature update... ## AAOS SDV - Secure by Design DevFeed: [AAOS SDV - Secure by Design]() Original publisher: [Read original article]() Author: Android Developers (noreply@blogger.com) Published: 2026-08-24T16:00:31Z Content type: article Language: en Sources: [Android Developers Blog]() Topics: [Android](), [Security](), [virtualization](), [virtual machines](), [SELinux](), [POSIX](), [Processes](), [Google]() Tags: [android](), [android-security](), [article](), [google](), [posix](), [process](), [security](), [selinux](), [virtual-machines](), [virtualization]() ### AI overview This article explains the security design of Android Automotive Operating System for Software Defined Vehicle (AAOS SDV). It describes virtualization for domain isolation, UID-based application and service sandboxing, POSIX capabilities, SELinux deny-by-default enforcement, and Android's vulnerability management and disclosure processes. ### Source excerpt Posted by Markus Vill, Software Engineer, Sean Keys, Security Engineer, and Istvan Nador, Software Engineer, Android Auto At Google, we believe our products should be secure by design, which is why we built the Android Automotive Operating System for Software Defined Vehicle (AAOS SDV) on existing, market-proven platforms, leveraging virtualization technologies like Cuttlefish. While our release announcements focused on the features, this blog post outlines some of the security concepts. Foundation: Domain IsolationVirtualization to isolate co-hosted instances The current trend of consolidating Electronic Control Units (ECUs) into a single chip reduces isolation by running multiple domains side-by-side. While AAOS SDV instances provide internal isolation mechanisms, it is often preferable to run logical domains independently. For instance, a cluster and an infotainment system have distinct requirements. We use virtual machines to run multiple instances in parallel, ensuring that sharing remains explicit and isolation is the default behavior. Inherited Android Security AAOS SDV evolved from Microdroid, a minimalistic Android version optimized for privacy virtual machines (pVM). This lineage provides Android platform engineers with established security features they already know. Process Isolation & Deny by Default AAOS SDV follows Android's User ID (UID)-based isolation model to set up a sandbox for each application. Each service runs in a dedicated process with a unique UID to manage access rights, data directories, and other restrictions. We employ Portable Operating System Interface (POSIX) capabilities to strictly limit operations and pair this with Security-Enhanced Linux (SELinux) to enforce a "deny-by-default" posture. This approach restricts each service to the absolute minimum required, meaning missing configurations block access rather than creating an over-permissive system. We apply this same strategy to our communication permission system, as explained l ## Vim: por qué merece la pena frente a nano DevFeed: [Vim: por qué merece la pena frente a nano]() Original publisher: [Read original article]() Author: Antonio Pérez Published: 2026-08-01T13:00:00Z Content type: tutorial Language: es Sources: [tengoping.com]() Topics: [Vim](), [POSIX](), [Unix]() Tags: [alpine](), [distro](), [editor](), [posix](), [unix](), [vim]() ### AI overview A practical Spanish tutorial explaining why Vim is worth learning instead of nano. It covers how to exit, save, undo, and redo, then argues that Vim is widely available on Unix systems because vi is required by POSIX. It also discusses BusyBox, Alpine, and Vim's modes. ### Source excerpt Vim parece complicado pero no lo es: aprende a salir, moverte y editar con lo mínimo imprescindible, sin miedo y sin memorizar todo de golpe. ## GNU Hurd Q2 2026 development updates DevFeed: [GNU Hurd Q2 2026 development updates]() Original publisher: [Read original article]() Published: 2026-07-03T20:32:51Z Content type: news Language: en Sources: [GNU Hurd]() Topics: [Code](), [POSIX](), [SVG](), [GitHub](), [virtio](), [Kernel](), [Wiki]() Tags: [2026](), [code](), [crash](), [cross-compilation](), [posix](), [servers](), [svg](), [virtio](), [wiki]() ### AI overview A quarterly GNU Hurd development update covering a public 9pfs repository with basic file browsing and reading support, additional write support, POSIX-related validation, bug fixes, cross-compilation work, Rust translator development, and planned dynamic device population. ### Source excerpt Hello and welcome to another Qoth! Here's what's been happening in Q2 of 2026! Joshua Branson added a pretty cool svg logo for our ethernet multiplexor. He built that image with Inkscape whilst using a Hurd laptop (Thinkpad 420) running on real iron! The Hurd wiki could certainly use more artwork. Perhaps you have a favorite Hurd translator that you believes needs some artwork! Sergey Bugaev announced his WIP 9pfs (source code), and it has a wiki page! He writes: Some years ago, I experimented with implementing a 9P translator for the Hurd. Hopefully there is no need to tell this list what 9P is :) Besides just browsing files on the few existing servers out there, a potential use case is virtio-9p, to enable shared directory trees between VMs and the host. But that would need someone to implement virtio support in the Hurd. I wanted to complete 9pfs before publishing, but that ultimately didn't happen, so now it's time to turn it over to the community. I now went and made the repository public on GitHub: https://github.com/bugaevc/9pfs What's implemented is basic browsing (readdir, stat), path resolution (dir_lookup), and reading files (io_read). And below that, the whole tracking for nodes, peropens, protids, fids, tags, and 9p RPCs. Improvements are welcome, send patches to this list with [PATCH 9pfs] in the subject. A good starting point would be to continue porting things that I had implemented in the old netfs-based version (see netfs.c) but didn't yet port to the new one. He then got a little more motivated, and he added some write support! Etienne Brateau added validation to msync, so that the Hurd better follows POSIX. Diego Nieto Cid worked on allowing privileged users to set their task priority (nice value). His patches landed in glibc and GNU Mach. He also fixed a tiny bug in our test suite. He fixed an adjtime bug, which is helpful to the OpenNTPD port, and he fixed two more bugs. Paulo Duarte sent a RFC patch series trying to commit Sergey's previous AA ## Coding Challenge #124 - Du DevFeed: [Coding Challenge #124 - Du]() Original publisher: [Read original article]() Author: John Crickett Published: 2026-06-13T08:01:14Z Content type: tutorial Language: en Sources: [Coding Challenges]() Topics: [Code Challenge](), [POSIX](), [Unix](), [Utility Software](), [Programming]() Tags: [coding](), [exercise](), [filesystem](), [posix](), [programming](), [programming-language](), [run](), [unix](), [utilities]() ### AI overview A coding challenge asks readers to build their own POSIX-compatible du utility. It covers recursively traversing directories, calculating disk usage, handling hard links and symbolic links, and presenting results in multiple formats. ### Source excerpt This challenge is to build your own du. ## ESP-IDF v6.0: Default libc Switches from Newlib to PicolibC DevFeed: [ESP-IDF v6.0: Default libc Switches from Newlib to PicolibC]() Original publisher: [Read original article]() Author: John Lee Published: 2026-04-02T00:00:00Z Content type: article Language: en Sources: [Blog on Developer Portal]() Topics: [ESP-IDF](), [C](), [Embedded Systems](), [migration](), [Streams](), [Library](), [POSIX]() Tags: [apis](), [architectures](), [blog](), [c](), [compatibility](), [embedded](), [embedded-systems](), [esp-idf](), [firmware](), [libc](), [libraries](), [memory](), [migration](), [newlib](), [performance](), [picolibc](), [posix](), [streams](), [systems](), [toolchains]() ### AI overview ESP-IDF v6.0 changes its default C library from Newlib to PicolibC. The article compares the libraries' memory usage, standard I/O behavior, compatibility, and migration considerations, including measurements on ESP32-C3. ### Source excerpt ESP-IDF v6.0 switches the default C library from Newlib to PicolibC. This article compares both libraries in terms of memory usage, stdio behavior, compatibility, and migration tradeoffs, and explains when keeping Newlib still makes sense. ## Introducing the SPIFFS component DevFeed: [Introducing the SPIFFS component]() Original publisher: [Read original article]() Author: John Lee Published: 2026-03-23T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [ESP-IDF](), [Filesystems](), [Streams](), [C](), [POSIX](), [ESP32]() Tags: [article](), [beginner](), [blog](), [c](), [esp-idf](), [filesystem](), [guide](), [posix](), [spiffs](), [storage](), [tutorial]() ### AI overview This practical guide introduces the SPIFFS component bundled with ESP-IDF for storing files on SPI NOR flash. It explains how SPIFFS works with the VFS layer and standard C and POSIX file APIs, describes features such as wear levelling, consistency checks, and format-on-mount, and outlines a basic flow for mounting, writing, renaming, and reading files. It also points to SPIFFSgen and an official working example. ### Source excerpt Learn what the ESP-IDF SPIFFS component is, how it works with the VFS layer and standard C file APIs, and how to use the SPIFFSgen tool to embed files. This article is a practical guide with references to the official example. ## Advanced techniques for porting libraries to ESP-IDF components DevFeed: [Advanced techniques for porting libraries to ESP-IDF components]() Original publisher: [Read original article]() Author: John Lee Published: 2025-11-24T00:00:00Z Content type: tutorial Language: en Sources: [Blog on Developer Portal]() Topics: [ESP-IDF](), [Library](), [AWS IoT Core](), [OpenSSH](), [WebSocket](), [aio](), [CMake](), [make](), [POSIX]() Tags: [blog](), [cmake](), [compiler](), [component](), [components](), [esp-idf](), [feature-flags](), [library](), [linux](), [mqtt](), [porting](), [posix](), [ssh](), [systems](), [techniques]() ### AI overview This follow-up article presents advanced techniques for porting larger libraries, particularly those designed for Linux or POSIX systems, into reusable ESP-IDF components. It covers assessing reusable code, adapting build systems and port layers, configuration, header injection, linker wrapping, and compiler-warning management, with examples including asio, mosquitto, libssh, and libwebsockets. ### Source excerpt This article follows up on the article 'Porting a library to an ESP-IDF component' and shows some advanced tips and tricks when porting larger libraries into ESP-IDF components. ## A Higgs-bugson in the Linux Kernel DevFeed: [A Higgs-bugson in the Linux Kernel]() Original publisher: [Read original article]() Author: Nikhil Jha Published: 2025-07-02T00:00:00Z Content type: tutorial Language: en Sources: [Jane Street]() Topics: [bug](), [Kernel](), [Linux](), [debug](), [Filesystems](), [POSIX](), [Security]() Tags: [bug](), [data](), [debug](), [filesystem](), [kernel](), [linux](), [linux-kernel](), [posix](), [security](), [trading]() ### AI overview A Jane Street engineering post investigates a difficult-to-reproduce bug affecting large file copies in Gord, a system that stores and distributes trading activity data. It explains the role of NFS, Kerberos authentication, and Linux kernel credential handling during the debugging process. ### Source excerpt We recently ran across a strange higgs-bugson that manifested itself in a critical system that stores and distributes the firm's trading activity data, called Gord. (A higgs-bugson is a bug that is reported in practice but difficult to reproduce, named for the Higgs boson, a particle which was theorized in the 1960s but only found in 2013.) In this post I'll walk you through the process I took to debug it. I tried to write down relevant details as they came up, so see if you can guess what the bug is while reading along. ## Converting a UTC Date-Time String to a UNIX Epoch Timestamp in C and C++ DevFeed: [Converting a UTC Date-Time String to a UNIX Epoch Timestamp in C and C++]() Original publisher: [Read original article]() Published: 2025-01-19T15:02:00Z Content type: tutorial Language: en Sources: [Bert Hubert's writings]() Topics: [C](), [POSIX](), [C++]() Tags: [c](), [c-plus-plus](), [posix](), [programming](), [unix](), [utc]() ### AI overview The article examines how to convert a UTC date-time string into a UNIX epoch timestamp in C and C++. It discusses unexpected behavior in POSIX time-handling functions and the complications caused by local times and daylight-saving transitions. ### Source excerpt So how hard could it be. As input we have something like Fri, 17 Jan 2025 06:07:07 in UTC, and we'd like to turn this into 1737094027, the notional (but not actual) number of seconds that have passed since 1970-01-01 00:00:00 UTC. Trying to figure this out led me to discover many 'surprise features' and otherwise unexpected behaviour of POSIX time handling functions as implemented in various C libraries & the languages that build on them. ## Signals, shells, and docker: an onion of footguns DevFeed: [Signals, shells, and docker: an onion of footguns]() Original publisher: [Read original article]() Author: raylu Published: 2024-05-22T16:01:32Z Content type: article Language: en Sources: [Benchling]() Topics: [POSIX](), [Bash](), [Processes](), [Docker]() Tags: [bash](), [docker](), [linux](), [logs](), [pipeline](), [pull-request](), [pytest](), [shell-script](), [terminal](), [testing]() ### AI overview This article investigates surprising POSIX signal behavior across shells and containers in Benchling's CI test pipeline. It explains how canceled test runs stopped forwarding logs while pytest continued running, then examines signal propagation through zsh, bash, and child processes. ### Source excerpt On a few occasions, we've needed to debug POSIX signals (SIGINT, SIGTERM, etc.). Inevitably, there's a shell involved too. One day, we were debugging some weird interaction between signals, shells, and containers and found ourselves bamboozled by some behaviors. People who consider themselves knowledgeable about Linux have found some of the details of our investigation surprising, so read on if this sort of thing doesn't make you want to defenestrate your laptop and become an alpaca-farming hermit. The scene of the crime At Benchling, we have a pretty standard testing/continuous integration (CI) setup: when you push code to a pull request branch, we run tests for you. A few years back, we added a little optimization: if you push again and tests are still running on the previous commit, we cancel the previous test run. You probably don't care about that run anyway and we save some money... or do we? The code that runs our tests is basically def test_pipeline() -> int: test_result = subprocess.run(["pytest", ...]) report_test_metrics() upload_artifacts() return test_result.returncode So our process tree is test_pipeline └──pytest subprocess.run blocks until the child process exits, so it should take almost all the time. We see in our CI logs that the tests get interrupted halfway through and then we see no more logs, so it sure looks like it's working. But we're able to get metrics and artifacts for our canceled runs, which makes no sense. We'll later discover that while we reported that the run was canceled and stopped forwarding logs, pytest just kept running. Back to basics Thinking that perhaps the problem was not forwarding a signal from test_pipeline to pytest, we thought about basic signal handling first. In a terminal running zsh, we can get the pid of zsh with $ echo $$ 20147 Then, we can run bash inside zsh and sleep infinity (like our tests, a very slow command) inside bash. $ bash $ sleep infinity From another shell, we can see the process tree. $ pstree -p 20 ## Why C's setenv() and unsetenv() Are Not Thread-Safe DevFeed: [Why C's setenv() and unsetenv() Are Not Thread-Safe]() Original publisher: [Read original article]() Published: 2023-11-19T14:13:23Z Content type: opinion Language: en Sources: [Evan Jones]() Topics: [C](), [POSIX](), [bug](), [Concurrency](), [Concurrent Programming](), [Go](), [Go Language](), [Rust]() Tags: [bug](), [c](), [crash](), [dns](), [go](), [posix](), [rust](), [thread]() ### AI overview The article explains that C's setenv() and unsetenv() modify global environment state and can race with getenv(), causing crashes in multithreaded programs. It argues that the POSIX interface is difficult to use safely and has affected software such as Go and Rust. ### Source excerpt You can't safely use the C setenv() or unsetenv() functions in a program that uses threads. Those functions modify global state, and can cause other threads calling getenv() to crash. This also causes crashes in other languages that use those C standard library functions, such as Go's os.Setenv (Go issue) and Rust's std::env::set_var() (Rust issue). I ran into this in a Go program, because Go's built-in DNS resolver can call C's getaddrinfo(), which uses environment variables. This cost me 2 days to track down and file the Go bug. Sadly, this problem has been known for decades. For example, an article from January 2017 said: "None of this is new, but we do re-discover it roughly every five years. See you in 2022." This was only one year off! (She wrote an update in October 2023 after I emailed her about my Go bug.) This is a flaw in the POSIX standard, which extends the C Standard to allow modifying environment varibles. The most infuriating part is that many people who could influence the standard or maintain the C libraries don't see this as a problem. The argument is that the specification clearly documents that setenv() cannot be used with threads. Therefore, if someone does this, the crashes are their fault. We should apparently read every function's specification carefully, not use software written by others, and not use threads. These are unrealistic assumptions in modern software. I think we should instead strive to create APIs that are hard to screw up, and evolve as the ecosystem changes. The C language and standard library continue to play an important role at the base of most software. We either need to figure out how to improve it, or we need to figure out how to abandon it. Why is setenv() not thread-safe? The biggest problem is that getenv() returns a char*, with no need for applications to free it later. One thread could be using this pointer when another thread changes the same environment variable using setenv() or unsetenv(). The getenv() function ## How SerenityOS declares ssize\_t DevFeed: [How SerenityOS declares ssize\_t]() Original publisher: [Read original article]() Author: Andreas Kling Published: 2023-04-04T00:00:00Z Content type: opinion Language: en Sources: [Andreas Kling]() Topics: [C](), [POSIX](), [Operating system](), [compilers](), [standard](), [Library]() Tags: [c](), [compilers](), [cpp](), [libraries](), [library](), [posix](), [serenityos](), [standard](), [technical](), [unix]() ### AI overview This article explains how SerenityOS declares ssize_t using a C preprocessor macro technique. It contrasts the approach with more architecture-specific declarations commonly used by other C libraries and notes the limitations of the hack. ### Source excerpt This post explores one of my favorite hacks in SerenityOS. I don't recommend doing this in your codebase, but it has worked for us so far. :^) ## My tmux workflow DevFeed: [My tmux workflow]() Original publisher: [Read original article]() Author: Carlos Alexandro Becker Published: 2022-06-06T00:00:00Z Content type: tutorial Language: en Sources: [Carlos Becker]() Topics: [Shell](), [hooks](), [Terminal](), [POSIX](), [ssh](), [dotfiles](), [Command-line interface]() Tags: [hooks](), [posix](), [shell](), [ssh](), [terminal]() ### AI overview A developer describes a tmux workflow for local and SSH-based remote work, including a project session selector that sorts projects by usage. The article then explains using a shell trap to avoid losing an SSH connection when exiting the last pane of a session. ### Source excerpt I wanted to share a quick thing that made my life easier on tmux lately, but before we dig into that, I feel like I need to explain how I usually work. ## Designing a Better \`strcpy\` DevFeed: [Designing a Better \`strcpy\`]() Original publisher: [Read original article]() Published: 2020-04-12T00:00:00Z Content type: article Language: en Sources: [Saagar Jha]() Topics: [C](), [Security](), [POSIX]() Tags: [c](), [compilers](), [function](), [memory](), [security]() ### AI overview This article examines the design of a safer and more efficient C string-copying function intended to preserve null termination, report truncation or overflow, minimize unnecessary memory access, support vectorization, and comply with portable standards such as ISO C or POSIX. ### Source excerpt Like them or not, null-terminated strings are essential to C, and working with them is necessary in all but the most trivial programs. While C-style strings are a fundamental part of using the language, manipulating them is a common source of security bugs and lost performance. One of the most common operations is copying a string from one buffer to another, and there are a variety of string functions that claim to do this in C. Anecdotally, however, there is much confusion about what they actually do, and many people desire a string copying function with the following properties: ## Configuring Shell Prompts to Warn About Privileged and Production Environments DevFeed: [Configuring Shell Prompts to Warn About Privileged and Production Environments]() Original publisher: [Read original article]() Published: 2018-06-21T16:21:00Z Content type: tutorial Language: en Sources: [Latacora]() Topics: [Shell](), [Bash](), [configuration](), [Zsh](), [systems](), [POSIX](), [Terminal]() Tags: [aws](), [bash](), [configuration](), [posix](), [shell](), [ssh](), [systems](), [terminal](), [variable](), [zsh]() ### AI overview This article explains how to make shell prompts more noticeable when users have elevated privileges or access to sensitive environments. It discusses shell differences, prompt configuration, and approaches such as rc-less shells, dedicated environment variables, and sourced scripts. ### Source excerpt Default shells usually end in $. Unless you're root and it's #. That tradition has been around forever: people recognized the need to highlight you're not just some random shmoe. These days we have lots of snazzy shell magic. You might still su, but you're more likely to sudo. We still temporarily assume extra privileges. If you have access to more than one set of systems, like production and staging, you probably have ways of putting on a particular hat. Some combination of setting an environment variable, adding a key to ssh-agent, or assuming an AWS role with aws-vault. You know, so you don't accidentally blow away prod. ## Windows for Linux Nerds DevFeed: [Windows for Linux Nerds]() Original publisher: [Read original article]() Published: 2017-09-09T15:25:24Z Content type: article Language: en Sources: [Jessie Frazelle]() Topics: [Windows Subsystem for Linux](), [Windows](), [Kernel](), [POSIX]() Tags: [kernel](), [posix](), [windows](), [wsl]() ### AI overview A developer describes learning Windows after joining Microsoft, with a focus on Windows Subsystem for Linux (WSL), its background, and aspects of how it translates Linux system calls through the Windows NT kernel. The article also mentions reproducibly setting up a Windows machine. ### Source excerpt I recently started a job at Microsoft. In my first week I have already learned so much about Windows, I figured I would try to put it all into writing. This post is coming to you from a Windows Subsystem for Linux console! I'm headed to Seattle because I'M JOINING MICROSOFT, at the airport wearing this awesome shirt from @listonb & @Taylorb_msft ���� pic.twitter.com/8rnAg1dsPd -- jessie frazelle (@jessfraz) September 4, 2017 New job and I got a Windows computer and a Linux computer! If you are new to my blog, let me tell you: I love setting up a perfect desktop experience. I've written a few posts on it (for Linux), you should check them out. Setting up a Windows computer is something I have not done in quite some time. I will describe a bit how to set up a windows machine in a reproducible way at the end of this post. I would like to thank Rich Turner, John Starks, Taylor Brown, and Sarah Cooley for taking the time to explain a lot of the following to me. :) Windows Subsystem for Linux (WSL) Let's start with Windows Subsystem for Linux, aka WSL. Even @monkchips wrote that since I joined Microsoft "Linux Subsystem for Windows will definitely be getting a workout." I am super excited about Windows Subsystem for Linux. It is one of the coolest pieces of tech I've seen since I started using Docker. First, a little background on how WSL works... You can learn a lot more about this from the Windows Subsystem for Linux Overview. I will go over some of the parts I found to be the most interesting. The Windows NT kernel was designed from the beginning to support running POSIX, OS/2, and other subsystems. In the early days, these were just user-mode programs that would interact with ntdll to perform system calls. Since the Windows NT kernel supported POSIX there was already a fork system call implemented in the kernel. However, the Windows NT call for fork, NtCreateProcess, is not directly compatible with the Linux syscall so it has some special handling you can read about more ## Notes on Unikernels and Memory Corruption Exploitation DevFeed: [Notes on Unikernels and Memory Corruption Exploitation]() Original publisher: [Read original article]() Author: yrp Published: 2016-12-22T02:59:00Z Content type: tutorial Language: en Sources: [Diary of a reverse-engineer]() Topics: [Kernel](), [POSIX](), [Vulnerabilities](), [toolchain](), [nginx]() Tags: [exploitation](), [kernel](), [memory-corruption](), [networking](), [nginx](), [posix](), [rumpkernel](), [toolchain](), [unikernel]() ### AI overview This article presents notes on unikernels, focusing on how applications can be compiled into a NetBSD-based kernel environment. It uses nginx and php5 examples to discuss memory corruption exploitation and payload options, then introduces a basic rumpkernel "Hello World" build process. ### Source excerpt Intro Below is a collection of notes regarding unikernels. I had originally prepared this stuff to submit to EkoParty's CFP, but ended up not wanting to devote time to stabilizing PHP7's heap structures and I lost interest in the rest of the project before it was complete. However ... ## Hardening Craft CMS Permissions DevFeed: [Hardening Craft CMS Permissions]() Original publisher: [Read original article]() Author: andrew@nystudio107.com (Andrew Welch) Published: 2016-12-05T05:42:00Z Content type: tutorial Language: en Sources: [nystudio107 | Articles on modern web development.]() Topics: [Content Management System](), [Security](), [Authorization](), [file](), [POSIX](), [Unix](), [Server](), [nginx](), [Livewire]() Tags: [cms](), [craft](), [file](), [file-permissions](), [getting](), [hardening](), [important](), [insights](), [laravel](), [nginx](), [permissions](), [point](), [posix](), [provisioning](), [right](), [security](), [server](), [unix](), [view]() ### AI overview A tutorial on hardening Craft CMS by configuring strict Unix file permissions that allow required webserver operations while limiting unauthorized modification and containing potential security exploit damage. ### Source excerpt An important part of hardening Craft CMS from a security point of view is getting the file permissions right ## Android Security: Welcome To Shell (Permissions) DevFeed: [Android Security: Welcome To Shell (Permissions)]() Original publisher: [Read original article]() Author: SystemDotRun Published: 2016-08-16T00:00:00Z Content type: tutorial Language: en Sources: [SystemDotRun]() Topics: [Android](), [Android Security](), [Security](), [Process](), [Kernel](), [POSIX]() Tags: [adb](), [android](), [android-security](), [kernel](), [posix](), [process](), [security]() ### AI overview This article examines whether a shell started by an Android application has the same permissions as a shell accessed through ADB. It explains that Android process privileges depend on UID, GID, supplementary GIDs, and kernel-enforced resource access, then compares shell processes from ADB and an installed application. ### Source excerpt Does a shell started from an application have the same permissions as a shell started via adb? What a good question! ADB is a shell that you get on a PC with the same permissions as if you were to run a shell/terminal app on the phone itself. I came across this statement on Reddit which went against my intuition and I had a quick look into it. It was important for me so I can understand the difference in potential attack vectors surrounding open shells. I started by flicking through the excellent Android Security Internals: An In-Depth Guide to Android's Security Architecture to get an overview about how process permissions worked on android. Most of the overview is just a condensed version of a few pages of this great book. This post will mostly talk about how this stuff works with low-level kernel permissions work in the OS, as opposed to high-level operations that involve the package manager (pm). A brief summary of the low-level stuff is: Privileges are based upon the processes UID, GID and supplementary GIDs Like all POSIX systems [clarification needed] access to system resources regulated by the kernel (files, sockets etc) is based on the owner and access mode of the resource and the UID & GID of accessing process Some permissions on Android are mapped to GIDs data/etc/platform.xml Other permissions are checked via pm and I'm guessing are not checkable by the process outlined in this post. These GIDs are mapped to AIDs android_filesystem_config.h For applications (quick diversion) the package manager will add the GIDs for the application at install time, for permissions that appear in the platform.xml file, to data/system/packages.list for the applications entry. When a process is forked from the zygote process, as it does for new application processes, the UID and GIDs are set. Kernel and system daemons use these to grant access to resources and functions. Relative shell permissions So, does a shell started from an application have the same permissions as a s ## Problème de connexion à Oracle DevFeed: [Problème de connexion à Oracle]() Original publisher: [Read original article]() Author: brice.dutheil@gmail.com (Brice Dutheil) Published: 2015-11-06T22:33:53Z Content type: tutorial Language: fr Sources: [The Coffee Workshop]() Topics: [Java](), [Randomizer](), [Linux](), [Firewall](), [POSIX](), [systems]() Tags: [firewall](), [http](), [java](), [jvm](), [linux](), [posix](), [random]() ### AI overview This article examines two causes of Oracle database connection problems that can lead to HTTP timeouts: insufficient system entropy and firewall connection termination. It explains how Java and POSIX random sources affect blocking behavior and discusses the security trade-off between /dev/random and /dev/urandom. ### Source excerpt Deux problèmes assez courant peuvent survenir sur les connexions à une base de donnée Oracle. Ces problèmes peuvent être à l'origine de timeout sur les connexions HTTP, etc... Ces deux problèmes touchent deux choses totalement différente, l'entropie du système et la coupure de connexion par un firewall. ## Raw sockets in Go: Link layer DevFeed: [Raw sockets in Go: Link layer]() Original publisher: [Read original article]() Author: Graham King Published: 2015-01-31T20:55:57Z Content type: tutorial Language: en Sources: [Graham King]() Topics: [Go Language](), [Network](), [Linux](), [Kernel](), [POSIX](), [Unix](), [Programming](), [Protocol (disambiguation)](), [Internet](), [HTTP]() Tags: [c](), [go](), [headers](), [http](), [ip](), [ipv4](), [ipv6](), [linux](), [network](), [network-programming](), [posix](), [programming](), [protocol](), [raw](), [socket](), [software](), [tcp](), [udp](), [unix]() ### AI overview A technical tutorial on using raw sockets in Go at the link layer. It explains receiving IP packets, inspecting and crafting IP headers, selecting address families and protocols, sending ICMP echo requests, and observing kernel responses. It also discusses Linux behavior and portability limitations for raw sockets. ### Source excerpt Diving deep into raw sockets and IP headers with Go: A technical exploration. [Next page]()