https://blog.omiilgo.com/tags/linux/ Recent content in Linux on Security Notes Hugo en-us Fri, 13 Feb 2026 10:00:00 +0800 https://blog.omiilgo.com/posts/container-escape-class-lessons/ Fri, 13 Feb 2026 10:00:00 +0800 https://blog.omiilgo.com/posts/container-escape-class-lessons/ Lab capsh –print and docker inspect seccomp/AppArmor, dropped caps, failed mount — no escape exploit. https://blog.omiilgo.com/posts/dirty-pipe-class-analysis/ Thu, 03 Mar 2022 10:30:00 +0800 https://blog.omiilgo.com/posts/dirty-pipe-class-analysis/ Toy splice/pipe lab on a temp file we own, uname -r vs CVE-2022-0847, SIGSEGV on a PROT_READ map — not a setuid hijack. https://blog.omiilgo.com/posts/aslr-and-information-leaks/ Wed, 20 Nov 2019 11:00:00 +0800 https://blog.omiilgo.com/posts/aslr-and-information-leaks/ /proc/self/maps across runs, gdb measurement of PIE load bias, a toy %p leak of a text pointer. Entropy is what remains after the leak — no exploit chain. https://blog.omiilgo.com/posts/linux-lkm-and-syscall-hooking-concepts/ Sat, 14 Sep 2019 10:00:00 +0800 https://blog.omiilgo.com/posts/linux-lkm-and-syscall-hooking-concepts/ Lab LKM that logs openat on a VM, insmod/rmmod, dmesg artifacts — module does not hide files or hook the table for concealment. https://blog.omiilgo.com/posts/format-string-vulnerability-patterns/ Wed, 08 May 2019 15:00:00 +0800 https://blog.omiilgo.com/posts/format-string-vulnerability-patterns/ Toy printf(user) lab: gdb dump of stack words matching a %p leak (canary included conceptually), SIGSEGV from %s, ASan on a sprintf companion, patched printf("%s", user).