enzoventuri.com

Posts

Thu, 16 Jul 2026 08:47:29 +0000

Posts

Small notes, longer complaints, and the occasional useful thing.

Plan 9 shell (rc) in Go

Thu, 16 Jul 2026 00:00:00 +0000

Plan 9 shell (rc) in Go

enzv/rc uses an rc script to compile itself.

% go run . make.rc build
built ./rc

rc is the part of Plan 9 I missed most when work pulled me back to Linux. Not the nostalgia. The grammar. It treats shell input like a language, not like string soup.

So I rebuilt it in Go as a standalone binary. No plan9port wrapper. No secondary shell. No CGO. One static binary you can ship, debug, and move around without dragging the rest of Plan 9 behind it.

The pipeline is the point.

ParseSource(src)
prepareSource(src)
Lex(prepared.Stripped)
parseTokens(tokens)
attachHereDocs(prog, prepared.HereDocs)
RunProgram(prog, opts)

Source is evidence. The tree is the contract. Execution is what happens after the parser turns noise into structure.

First comes bookkeeping, not parsing. The source walker tracks quotes, comments, and heredoc markers before the lexer ever sees the input. That keeps the lexer from guessing where the body ends and the syntax begins.

for i := 0; i < len(src); {
    ch := src[i]
    if inComment {
        ...
    }
    if inQuote {
        ...
    }
    switch ch {
    case '<':
        if i+1 < len(src) && src[i+1] == '<' {
            pending = append(pending, scanHereTag(src, i+2))
            ...
        }
    case '\n':
        ...
    }
}

That pass exists for one reason. Heredocs need to land on the right node later. If you capture them too late, function bodies start lying about what they contain. Shells already have enough ways to lie.

The lexer is stateful because shell syntax is stateful. It remembers whether the previous token was a word. It remembers whether $ should trigger identifier mode. It remembers quotes, comments, and continuation because context changes the meaning of the next byte.

func (lx *Lexer) nextToken() (LexToken, error) {
    if lx.lastWord {
        ...
    }
    lx.skipWhite()
    pos := lx.position()
    c := lx.advance()
    switch c {
    case '$':
        ...
    case '`':
        ...
    }
    ...
}

Tokens keep the facts that matter. Quoted, Glob, RType, FD0, FD1, and Pos. Later stages do not need to rediscover intent from raw bytes. They can read what the lexer already proved.

The tree stays small on purpose. A Program carries the original tokens, node array, offset table, here-doc map, and root id. That is enough to parse, print, expand, and execute without inventing a second representation for every phase.

Program{
    Tokens:   tokens,
    Nodes:    nodes,
    Offsets:  offsets,
    HereDocs: hereDocs,
    Root:     root,
}

One tree. Many readers. No translation layer trying to be clever behind your back.

The evaluator walks the tree directly. No bytecode. No VM frame. No generic command executor pretending every shell construct is the same thing.

func (r *runner) exec(id int) error {
    node := r.prog.Node(id)
    if node == nil {
        ...
    }
    switch node.Type {
    case ';':
        ...
    case '&':
        ...
    case tokenSimple:
        ...
    case tokenFn:
        ...
    }
}

That switch is the whole job. rc does not flatten control flow into one universal path. Conditionals, loops, functions, word lists, subshells, redirections, and pipelines all keep their own rules. They should. The shell is not one thing with different hats.

^ is list-aware concatenation, not casual string glue. If one side is a scalar and the other is a list, the scalar expands across the list. If both sides have the same length, they join pairwise. If they do not line up, the command fails. No made-up shape. No polite lie.

That is the whole trick. Keep the shape when the shape makes sense. Fail when it does not.

func concatWords(left, right []wordValue) ([]wordValue, error) {
    if len(left) == 0 || len(right) == 0 {
        return nil, fmt.Errorf("null list in concatenation")
    }
    switch {
    case len(left) == len(right):
        ...
    case len(left) == 1:
        ...
    case len(right) == 1:
        ...
    default:
        return nil, fmt.Errorf("mismatched list lengths in concatenation")
    }
}

That is the kind of algorithm rc wants. Shape-preserving. Strict when it has to be. Small enough that a human can still reason about it without pretending they love writing parsers.

The environment is not one big string map. It keeps raw variables, encoded word values, function bodies, a job table, a current directory, branch state, and runtime flags. That split is what keeps PATH, IFS, $*, and fn#name=... from collapsing into sludge.

func (e *shellEnv) exportEnv() []string {
    var env []string
    if path, ok := e.words["path"]; ok {
        ...
    }
    for name, values := range e.words {
        ...
    }
    for name, body := range e.fns {
        ...
    }
    return env
}

vars stores the plain shell view. words stores the glob-aware shell view. That means a variable can round-trip through expansion and export without losing the shape it had when the user set it.

IFS matters because tiny shell rules break big command lines. An empty IFS means no splitting. Add characters to it and each character becomes a delimiter. That behavior is explicit, local to the environment, and not buried in a helper with mysterious defaults.

func splitByIFSWords(output string, env *shellEnv) []wordValue {
    ifs := " \t\n"
    if v, ok := env.vars["ifs"]; ok {
        ...
    }
    if ifs == "" {
        ...
    }
    for _, ch := range output {
        ...
    }
    return words
}

Command substitution uses the same rule. Run the subtree, capture stdout, then split the result through the current IFS behavior. No special parser for captured text. No one-off exception pretending it is not part of the language.

Globbing follows the same logic. Literal markers, wildcard markers, bracket classes, and dotfile rules stay separate from command execution. Completion, expansion, and printing can all share the same semantics without inventing their own little lies.

func matchSegment(subject, pattern string, stop rune, relaxed bool) bool {
    for len(pattern) != 0 {
        r, size := utf8.DecodeRuneInString(pattern)
        if r == stop {
            ...
        }
        switch r {
        case globMark:
            ...
        case '*':
            ...
        case '?':
            ...
        case '[':
            ...
        }
    }
    return subject == ""
}

The useful property is that the matcher only recurses where the syntax demands it. That keeps the implementation small and the failure modes visible. No hidden behavior. No ambient search path outside the inputs.

Here-docs stay attached to the node that owns them. Quote the delimiter and the body stays literal. Leave it unquoted and it expands. The parser already decided. The evaluator just carries the decision forward.

func (r *runner) applyRedir(id int) (io.Closer, bool, error) {
    node := r.prog.Node(id)
    switch node.Type {
    case tokenDup:
        ...
    case tokenRedir:
        ...
    }
    return nil, false, fmt.Errorf("unsupported redirection node %s", tokenName(node.Type))
}

Redirection order is source-order sensitive. The code collects the chain first, sorts by source offset, and applies each step in sequence. >[...] , <[...] , <<, and file targets do not commute. Get that wrong and the script says something else entirely.

Process substitution is plumbing, not magic. os.Pipe creates the transport. One end is bound to the child. The other is returned as a /dev/fd/N path so the rest of the shell can treat it like ordinary redirection.

func (r *runner) execProcSub(id int) ([]string, error) {
    pr, pw, err := os.Pipe()
    if err != nil {
        ...
    }
    ...
    go func() {
        sub.exec(node.Child[0])
        ...
    }()
    return []string{procSubFDPath(osFd)}, nil
}

& follows the same pattern, but the contract is different. The child gets a cloned environment and its own job bookkeeping. The parent gets a virtual pid in $apid and keeps going. That keeps background execution cheap without pretending fork semantics are free in Go.

func (r *runner) execAsync(id int) error {
    sub := r.child(r.env.clone())
    ...
    r.env.jobs.jobs[pid] = done
    ...
    go func() {
        sub.exec(node.Child[0])
        ...
    }()
    return r.exec(node.Child[1])
}

I wanted that tradeoff to be visible. This is not Plan 9 process semantics with the edges sanded off. It is a Go-native mapping that preserves the shell behavior users can see while keeping the runtime sane.

The interactive loop had to be native or it was not worth shipping. Raw TTY mode, bracketed paste, history, cursor movement, line clearing, and Ctrl-V are one feature. Usable input without an external wrapper.

oldState, err := term.MakeRaw(fd)
defer term.Restore(fd, oldState)
enableBracketedPaste()
defer disableBracketedPaste()

The refresh path tracks rendered rows and cursor position. It clears only what it needs. It redraws from the current buffer instead of trying to patch terminal state with guesses. That matters once a command wraps or pasted text spans multiple lines.

The prompt is not a dumb string either. If prompt is a function, the shell runs it. Then it restores status so prompt logic does not leak into command semantics. Small detail. Big difference.

Signals stay literal too. SIGINT, SIGQUIT, SIGHUP, and SIGALRM dispatch to matching rc functions if they exist. Otherwise the shell falls back to its current exit code. Interrupts should be visible, not buried in runtime tricks.

rfork is where the port has to admit reality. The parser takes the combined flag string. The validator rejects combinations the host cannot represent. The executor maps e, E, F, s, n, f, and m onto what Go and the OS can actually do. Fake success is worse than a clean failure.

flags, err := parseRforkArgs(args)
if err != nil {
    ...
}
if err := r.applyRfork(flags); err != nil {
    ...
}

That is the line I wanted to keep visible. The shell should fail where the abstraction boundary is real. It should not blur the difference between supported and unsupported behavior just because the original syntax looked nicer.

The tests close the loop. We compare our rc against plan9port byte for byte, including stdout, stderr, exit status, and the rest of the observable behavior. The corpus under testdata/*.rc keeps that comparison grounded. That is enough to keep the language honest without turning the post into a checklist.

I did not rebuild rc to decorate Unix. I rebuilt it to keep the language honest while letting Go carry the process model. Explicit ASTs. Explicit expansion. Explicit status. Explicit failure. That is the point.

The do_exit File Descriptor Heist

Mon, 29 Jun 2026 00:00:00 +0000

The do_exit File Descriptor Heist

People think process termination in Linux is a clean, atomic event. You pull the trigger. The process dies. Memory vanishes. Resources get freed. Done.

It isn't. CVE-2026-46333 proves it.

Process death is a multi-step bureaucracy managed by do_exit(). And like any bad bureaucracy, if you move fast enough during the paperwork, you can steal the office furniture.

Inside exit.c, the kernel cleans up the corpse in stages. This creates a temporal gap that is ripe for exploitation.

Here is what that looks like:

[ Process Active ]
        |
  do_exit() called
        |
        v
+---------------+
| exit_mm()     | ---> task->mm = NULL (Memory map destroyed)
+---------------+
        |
        | <--- VULNERABILITY WINDOW (The Zombie Phase)
        |      task->mm == NULL, but task->files is STILL VALID!
        v
+---------------+
| exit_files()  | ---> File descriptors finally closed
+---------------+
        |
[ Process Dead ]

There is a narrow race window. The process has no memory map. But its file descriptor table is still fully populated with the privileged files it was authorized to open. Attackers cannot read arbitrary files; they abuse specific SUID binaries like "chage" or "ssh-keysign" to steal the exact file descriptors those binaries had legitimately opened before dying.

Security systems frequently use a null memory map as a proxy for "the process is gone." That is a lie. The process is a brain-dead zombie. But its hands are still clutching loaded guns.

This is compounded by a severe logic regression. In the v4.10-rc1 development window, commit bfedb589 (titled “mm: Add a user_ns owner to mm_struct and fix ptrace permission checks”) rewrote part of the ptrace authorization path. By the time the kernel shipped to production in early 2017, the authorization logic had been silently inverted.

Before the refactor, the kernel explicitly denied access if a task's memory map was null. After the refactor, the check simply fell through to a successful "allow" state.

But the tragedy is not the bug. The tragedy is the ecosystem.

In 2020, Jann Horn from Google Project Zero noticed the exact architectural flaw. He proposed a patch. However, the concern did not result in a merged fix. The time bomb kept ticking across affected Linux deployments for nearly six more years.

On May 11, 2026, the Qualys Threat Research Unit (TRU) found the live wire and reported it privately to the upstream Linux kernel security contact, engaging linux-distros before moving to public OSS-Security. Three days later, on May 14, Linus Torvalds pushed a patch to the public repository with his classic deadpan description: "ptrace: slightly saner 'get_dumpable()' logic". A cute way to describe patching a gaping hole.

Hours later, an independent researcher known as "_SiCk" looked at the public commit, reverse-engineered the logic, and dropped public exploits on GitHub: "ssh-keysign-pwn" and "chage_pwn".

By May 15, the embargo had completely collapsed. Distributions accelerated patch releases while attackers were already running the code.

In the open-source kernel, the patch is the exploit documentation. If you rely on the speed of your vendor's patches, you have already lost the race.

The exploit is not that Linux leaves arbitrary secrets lying around after process death. The exploit is that, during a narrow exit window, ptrace-style authorization can misclassify a dying privileged task, allowing an attacker to duplicate file descriptors that the privileged process already opened.

The upstream kernel finally patched it in stable tags like versions 7.1, 7.0.8, 6.18.31, 6.12.89, 6.6.139, 6.1.173, and 5.15.207 (note that distribution package versions will vary wildly). Debian pushed fixes for Bullseye, Bookworm, and Trixie. RHEL, AlmaLinux, and Rocky Linux patched branches 8, 9, and 10.

But here is a grim detail about exploitability versus vulnerability.

AlmaLinux 8 has the exact flawed kernel logic. However, the current public Proof of Concept exploits fail against it. Meanwhile, AlmaLinux 9 and 10 fall over immediately when hit with the same PoC.

This proves exactly why defenders must separate the exploitability of a system from its underlying vulnerability. Just because a GitHub script fails today does not mean the kernel will not betray you tomorrow.

To pull off the heist, an attacker targets a privileged SUID binary via pidfd_open. Then they spam pidfd_getfd. Because the attacker spawned the target SUID binary, they are technically the parent process.

They race the teardown. When they hit that exact exit_mm window in the diagram above, the target's memory map is null. The access check falls through. They clone the target's file descriptors.

Standard user-path telemetry struggles with this descriptor cloning because path attribution and file descriptor provenance are lost.

A SIEM is looking for open() or openat2() syscalls. But the attacker didn't open the target file. The SUID binary did.

The attacker just copied the file descriptor from the target's pocket while it was dying. A file descriptor number like "FD 3" is meaningless without process context. When the target process dies a microsecond later, that context is gone forever.

Path-based auditing is a lock on a door when the thief is already inside, copying the keys.

High-level eBPF frameworks like Tetragon will tell you who the thief is. They enrich system calls with UIDs, container namespaces, and Kubernetes pod metadata perfectly. A simplified tracepoint event for this behavior looks like this:

{
  "process_tracepoint": {
    "process": { 
      "binary": "/tmp/exploit", 
      "uid": 33,
      "pod": { "namespace": "prod", "name": "web-frontend-hash" }
    },
    "sys_enter": { 
      "syscall_name": "sys_pidfd_getfd" 
    },
    "args": [
      { "pidfd": 5 }, { "fd": 3 }
    ]
  }
}

But they don't inspect the internal memory pointer or the exiting flags of the target. High-level context tells you who is acting. To confirm the exact mechanism of the vulnerability, we need a custom surgical eBPF sensor. We need the ground truth.

To get it, you might think about dropping into the Linux Security Module (LSM) layer. You could hook lsm/ptrace_access_check to block the attack.

But here is the grim reality of enterprise infrastructure. Many cloud VMs and managed distributions do not ship with CONFIG_BPF_LSM=y enabled by default. Or they require modifying GRUB boot parameters, which is a non-starter in managed environments.

If you want truly portable, passive defensive observability, you don't use LSM. You use standard tracing trampolines. You use fentry.

You could write a full fentry probe in C, but dumping the whole file here is a waste of time. Let's look at the core logic that actually matters.

First, we hook the authorization function.

SEC("fentry/security_ptrace_access_check")
int BPF_PROG(on_security_ptrace_access_check, struct task_struct *child, unsigned int mode) {

We chose fentry/security_ptrace_access_check. This lets us read the memory states directly without altering the kernel execution path. We don't need LSM enforcement privileges to just watch the gate.

Second, we read the target's internal state.

target_flags = BPF_CORE_READ(child, flags);

We use the BPF CO-RE macro BPF_CORE_READ. Assuming the target kernel has BTF metadata enabled (CONFIG_DEBUG_INFO_BTF), this vastly improves portability across different kernel versions, assuming compatible types and verifier constraints.

Third, we filter out the noise.

if (target_flags & PF_KTHREAD) return 0;

We explicitly discard true kernel threads. We check if the target has the PF_KTHREAD flag set. If it does, we bail. We only care about user-space processes masquerading as kernel threads because their memory map is gone.

Fourth, we extract the smoking gun.

mm = BPF_CORE_READ(child, mm);
event->target_mm_null = mm == NULL;

We check if the target's memory map is null. But a single condition does not equal compromise. You must correlate a pidfd_getfd syscall with a non-kthread target whose mm == NULL during exit. This correlation is a high-signal indicator of the exploitation phase.

Finally, we ship the evidence.

bpf_ringbuf_submit(event, 0);

We package this high-fidelity evidence and push it asynchronously to user-space using a BPF ring buffer.

If you are not in a position to deploy custom eBPF sensors, you need to rely on static mitigation while operations applies the kernel patches.

Because pidfd_getfd relies on ptrace authorization, the Yama Linux Security Module governs it. By default, most distributions ship with kernel.yama.ptrace_scope = 1.

Level 1 allows a parent process to attach to its child. Since the attacker's script spawned the target SUID binary, the attacker is technically the parent. Yama happily assumes this is safe and allows the attach. The race condition succeeds.

You can break the chain entirely by raising the scope to Admin-only attach.

sysctl -w kernel.yama.ptrace_scope=2

At Level 2, Yama strictly requires the CAP_SYS_PTRACE capability for any process attachment. The unprivileged attacker does not have this capability. The kernel returns -EPERM immediately, rendering the race unreachable.

Keep in mind that you can dynamically lower the scope from 2 to 1 at runtime. But if you set it to 3 to disable ptrace entirely, you cannot lower it again without rebooting the host. Plan accordingly.

The risk does not end on monolithic servers. Containers share the underlying worker node kernel. An unprivileged pod can pack its own SUID binary and attack the host kernel from the inside.

The RuntimeDefault seccomp profile acts as a highly effective surface reduction. In many standard Docker or containerd setups, it blocks the pidfd_getfd syscall entirely, though this remains environment-specific.

But there is a trap in Kubernetes Pod Security Standards (PSS). The Baseline standard allows minimal/default pod configs which can be an illusion of security in this context Juliet Security. PSS Baseline explicitly prohibits "Unconfined" profiles, but it allows you to leave the seccomp field empty (unset).

Unless kubelet seccompDefault is enabled, an unset seccomp field can translate to Unconfined. The vulnerability is totally exposed.

The PSS Restricted profile is designed to stop this attack. It requires seccomp to be explicitly set to RuntimeDefault or an approved Localhost profile, and it also forces allowPrivilegeEscalation: false, which activates NoNewPrivs and nullifies the effect of any SUID binary inside the container.

If a vulnerable host was exposed to untrusted local users before patching, assume compromise.

You must rotate all SSH host private keys. If host-based authentication is not strictly required, remove the SUID bit from utilities like ssh-keysign.

chmod u-s /usr/lib/openssh/ssh-keysign

User-space logs describe what the process admitted doing. Kernel state describes what actually happened.

Text In, HTML Out

Sat, 27 Jun 2026 00:00:00 +0000

Text In, HTML Out

This is a blog.

It is made of text, which appears to be a difficult architectural concept now.

The files end in .godoc. Go parses them with go/doc/comment. A tiny program wraps the result in html/template, writes static files to public, emits RSS and a sitemap, then stops.

That is the system.

No dashboard. No database. No admin panel. No plugin bazaar. No content model pretending to be a worldview. No YAML altar where simple ideas go to become incident reports.

Text goes in. HTML comes out.

The engine is embarrassing.

var parser comment.Parser
doc := parser.Parse(src)

var printer comment.Printer
html := printer.HTML(doc)

That is most of the trick.

If I need prose, I write prose. If I need HTML, I write HTML. Not a shortcode. Not a component. Not a sacred template partial with three undocumented parameters.

There is a <raw> escape hatch for trusted HTML, because HTML is not contraband and a personal blog does not need a committee to approve a figure tag.

The generator reads content, copies static files, renders .godoc files, wraps pages, lists sibling posts from index.godoc, writes RSS, writes a sitemap, and stops.

Stopping is a feature.

Most tools do not stop. They discover themes. Then taxonomies. Then assets. Then pipelines. Then front matter. Then migrations. Then a Github issue where someone explains why your paragraph did not render because the date field had opinions.

This is for text.

The server does not need to think. It needs to hand over files. Static files are portable, cacheable, inspectable, and boring in the healthy way. Boring is what you want from publishing infrastructure unless your hobby is apologizing to your future self.

Design is not absent here. It is just not performing.

The page has words. The words are readable. Links are links. Titles are titles. The browser can do its job without being escorted by a JavaScript framework wearing a headset.

Every feature sounds reasonable alone.

Tags sound reasonable. Pagination sounds reasonable. Draft states sound reasonable. Image processing sounds reasonable. Search sounds reasonable. Themes sound reasonable. Then one day you are reading release notes to publish six paragraphs about a network interface.

No.

This is a blog.

It parses text.

It writes HTML.

That should not feel radical. The fact that it does is the bug.