Kernel
guest@6admin.io:~$ ls ~/tags/kernel
Linux is just the kernel
A useful bit of pedantry about what Linux actually is, then the substantive point: the layers people use to rank sysadmin profiles measure the distribution, not the system and the kernel stays the common denominator.
The boot chain, from GRUB to UKI
Why Canonical is trimming signed GRUB for 26.10, why GRUB-encrypted /boot was a false friend and what the modern answer to the Evil Maid attack actually looks like.
Containers, micro-VMs and Firecracker: why isolation is not what you think
Containers share the kernel. A container escape is a kernel escape. Firecracker micro-VMs bring hardware isolation at container speed. The chroot and the link are two different things.
Portable assembly does not exist
A concrete inventory of everything that changes from one OS to another once you drop down to assembly: assemblers, executable formats, ABIs, calling conventions and system calls. Spoiler, the word portable does not survive the trip.
Docker hardening
Docker hardening: the daemon, capabilities, mounts and why a container escape is a kernel escape.
Filesystem hardening
Filesystem hardening: mount options, permissions, SUID, immutable attributes and partition separation.
Recompiling your kernel: bespoke kernels for your own infra
The deepest form of hardening by subtraction: compile your own kernel, strip at build time the subsystems you never use, ship it as a .deb in your own repo with pinning and manage it at scale with Katello. The thrill and its price: a test pipeline on real hardware and canaries.
Linux OS and kernel hardening
OS and kernel hardening: sysctl, signed modules, accounts, sshd and the settings that hold up in production.
Nemesis: detecting a network sniffer
Detecting promiscuous-mode cards on your network, the defensive side of the packet forge.
Linux: introduction to LKMs
Loadable Kernel Modules, how the Linux kernel loads code at runtime and what it means for security.
Linux syscalls
Syscalls, the boundary between user space and the kernel and how to observe them with strace.
Magic SysRq: the sysadmin's crutch
The kernel SysRq key, the REISUB sequence and why it is the last thing you do before pulling the plug.