Recent content on blog.gnoack.org
Splitting a git commit is now easy, using: 
 git history split ${REF}
 
 It will ask you hunk by hunk for the things to include in the first commit, and then bring up the editor for the first and second commit message. It couldn’t be simpler than that. 
 P.S.
The stack overflow question for splitting commits discusses the old and cumbersome approach. The 20th answer…
I discussed previously that AI projects have a short lifespan, on average . 
 This one is a related hypothesis,
which I believe we are starting to see in the AI-adjacent software engineering domain already,
and which might spill into other domains soon: 
 
 Hypothesis: 
With the changing economics of software creation,
we will see more software which is produced on…

 The Lindy Effect 
is a theorized phenomenon by which the future life expectancy of some non-perishable thing, like a technology or an idea, is proportional to its current age. 
 
 The project age is now the first thing I check when people advertise their side projects on Hacker News. And for a surprising amount of projects, the age is less than a week. Which makes the expected…

 I did not expect that I’d quote the Catholic Church on this blog.
But they do a good job at expressing the problems with Transhumanism. 
 From the Encyclical Letter Magnifica Humanitas 
(emphasis mine): 
 
 Underlying narratives: transhumanism and posthumanism 
 
 
 In an attempt to shed light on the cultural assumptions accompanying the ongoing digital…

 
 Objective 
 
 Hypothesis 
 
 Implementation 
 
 Measurements 
 
 Effects on Landlock code complexity 
 
 Effects on Performance 
 
 Noteworthy results: 
 
 
 
 
 
 Conclusion 
 
 Full results 
 
 fs_bench 
 
 net_bench 
 
 scoped_bench 
 
 
 
 Objective 
 Landlock…
To extract text between two regular expressions, use sed -n '/first_regex/second_regex/p' . 
 For instance, to ad-hoc extract the function definition of the test tsync_override_log_subdomains_off , use: 
 sed -n '/TEST_F(audit, tsync_override_log_subdomains_off)/,/^}/p' \
 tools/testing/selftests/landlock/audit_test.c
 
 This assumes that the function ends with a single } on an…

 With Linux 7.0, Landlock gains the new LANDLOCK_RESTRICT_SELF_TSYNC feature . 
 With this new flag to the landlock_restrict_self(2) system call,
the Landlock policy enforcement is applied to the entire process 
rather than just the calling thread. (The naming is analogous to
the similarly named SECCOMP_FILTER_FLAG_TSYNC flag for Seccomp-BPF.) 
 The old workaround 
…
The big question for science is: Does it stay on the ground in the jar, or does it form floating lumps? 

Is your test in the business of calculating the expected output from the inputs? 
 Then your test is duplicating the logic from the code under test. 
 There is a reason why too much logic in tests is frowned upon :
If you implement the same logic twice,
you are prone to repeat the same mistakes in the test which you already made in the real implementation . 
 for c in [
…
Mickaël’s FOSDEM talk about the Island sandboxing tool : 
 https://fosdem.org/2026/schedule/event/EW8M3R-island/ (with 📽️ video!) 
 The Island sandboxing tool comes with tight integration with the zsh , to make sandboxing a part of the everyday workflow. 
 When you use that integration, the directory that you are in determines the Landlock policy which is then applied to the…

 The time is overdue. Stevie Wonder is amazing. 🎉 

I will be at FOSDEM 2026 this year,
with a hunger for Belgian waffles
and a big bag of freshly printed Landlock stickers. 
 I am looking forward to meeting you all again there! 
 If you are dropping by, and want to chat in person, send me a note! 
 I am collecting links over at https://wiki.gnoack.org/FosdemTwentySix . (You might want to double check regarding a potential…
I am excited to share that my team at Google,
Google Big Sleep,
has published the reports
for a few (now fixed) Linux kernel vulnerabilities: 
 
 BIGSLEEP-458654612 
 BIGSLEEP-462435176 
 BIGSLEEP-463332873 
 
 The full public list of issues discovered by Google Big Sleep
is at https://goo.gle/bigsleep . 

The following script takes an email on stdin and constructs the associated lore.kernel.org link based on the email’s Message-ID header. The script copies the link to the Wayland clipboard and posts a notification. 
 The escaping story is not perfect, but at least it is secure. (It only supports the most common characters in the message ID, but then it also can’t accidentally be…
The classic TCP client/server interaction 
 When a TCP client calls connect (2) , it usually gets assigned a port number from the ephemeral port range which is not used yet. 
 The server, on the other hand, usually calls bind (2) 
to set the port that it will listen on. 
 
 
 
 Server 
 
 
 
 socket() 
 
 
 
 bind() 
 
 
…
While I wasn’t looking, C23 has standardized checked integer arithmetic functions , replacing the old “ __builtin_mul_overflow() ” compiler intrinsics that shipped with GCC and Clang . 
 #include <stdckdint.h>
bool ckd_add(type1 *result, type2 a, type3 b);
bool ckd_sub(type1 *result, type2 a, type3 b);
bool ckd_mul(type1 *result, type2 a, type3 b);
 
 The…

 We’ve all heard the horror stories where an unsandboxed coding agent
deletes the user’s entire home directory.
As a mitigation,
many vibe coding tools are now using Docker to contain the agent’s actions. 
 Unfortunately, Docker is not a good tool to keep the vibe coding agents at bay .
To quote Docker’s own documentation (emphasis mine): 
…

 When I posted about the Emacs mouse
bug in February, I
looked into the patch set again, and of course spotted more mistakes.
 This
patch 
simplifies and corrects some inconsistent logic in where
 CAP_SYS_ADMIN was required. The change does not make a difference
for existing terminal mouse driver programs like GPM or Consolation,
but it is noteworthy for the…

 I accidentally broke Emacs mouse support on the Linux console. o_O 
 The TIOCLINUX patch for disabling dangerous IOCTLs for the Linux
console driver ( background discussed on the
Wiki ) ended
up accidentally making the mouse cursor invisible on the Linux console
(the proper text mode one, not xterm). 
 I apologize for breaking this. We luckily found a patch for it and…
People have apparently started believing that in order to use git,
you’d have to also have to host the project on Github or Gitlab: 
 
 A few weeks ago, a friend told me that he keeps his pass password repository on Github. 
 Beej wrote a guide on git and the Github workflow is very prominent in it 
 I came home from FOSDEM with a Github and a Gitlab sticker, but not with…
Thoughts on sandboxing, found via Aaron Swartz’s
weblog , who in turn found it in
 a writeup about Dan Bernstein’s 2005 research
activities (at the end): 
 
 The software installed on my newest home computer contains 78
million lines of C and C++ source code. Presumably there are
hundreds of thousands of bugs in this code. Removing all of those
bugs…
I will be attending the following conferences: 
 
 Vintage Computer Festival Zurich , January 18-19, 2025 
 FOSDEM 2025 , February 1-2, 2025
 
 I am collecting a few interesting talks over on the wiki 
 Obligatory Landlock talk: Sandbox IDs with Landlock 
 We have Landlock stickers this time :) 
 
 
 
 If you happen to be at one of these venues,
if…
📢 I gave a talk about the recent changes in Landlock and its new
 support for restricting IOCTL
usage at the Linux
Security Summit Europe 2024 in Vienna: 
 
 🌍 Talk page 
| 🎥 Video on YouTube 
| 😎 We have stickers! 
 Talk Summary 
 
 The Landlock security module lets Linux processes restrict what they
can do and puts developers in charge of defining…
In the context of Alejandro Colomar stepping down as a man-pages maintainer :(, I learned from him that
it is possible with git to create an email patch set that spans multiple target repositories.
Specifically, he pointed to a review thread by Jiri Olsa where this was done, and whose outline takes a similar shape to this (simplified): 
 
 [PATCH proj v3 0/3] foobar: Add…
📢 I will give a talk about the recent changes in Landlock and its new
 support for restricting IOCTL
usage at the Linux
Security Summit Europe 2024 in Vienna: 
 
 The Landlock security module lets Linux processes restrict what they
can do and puts developers in charge of defining appropriate
sandboxing policies for their programs. We will give a brief
overview over…
Landlock’s IOCTL support for device
files has landed in
Linux 6.10 🚀. 
 I also merged the IOCTL support in the Go-Landlock
library ,
so you can easily play around with it already. 
 In other news, I started informally documenting Landlock usage in C on
 my wiki on the LandlockUsage
page . 

This has always been true, but it begs repeating: 
 Every docstring should provide additional information 
about the thing that it is documenting,
 which is not obvious from the thing’s name and its type information. 
 
 And the corollary: 
 If an LLM could generate the same docstring for you ,
based on the name and type information alone,
 then the docstring…

 
 Introduction 
 
 This feature is mis-documented 
 
 /dev/fd/* behave different on other Unixes 
 
 
 
 Part 1: An experiment! 
 
 Duplicating the file descriptor using dup(2) 
 
 Duplicating the file descriptor through /proc 
 
 Other file types 
 
 TCP Sockets: Can not be reopened through /proc 
 
 Pipes: Can be…

 In Linux 6.7, Konstantin Meskhidze introduced TCP Networking support
for Landlock. 🚀 I am happy to announce that Go-Landlock is one of the
first libraries using it, and it has a demo tool. 
 Demo 
 If you are running Linux 6.7 or higher and have Landlock enabled, you can try it out like this: 
 
 
 Install the tool to ~/go/bin : 
 go install…
Twitter 
 
 Posting: You can tweet, but the public can’t read it 1 . 
 Reading: Most of my timeline is garbage. 
 
 Mastodon 
 
 Posting: Everything is quasi-public, and instance operators are all-knowing gods 2 . 
 Reading: All of my timeline is garbage. 
 
 I’m sad for Mastodon. It would have been an opportunity to reverse
the…
I wrote a tool, Mailprint ,
for printing out nice-looking emails from Mutt 
and other classic Mail user agents. 
 (You might remember from the last article 
that I have recently spent some time to polish my e-mail setup for kernel development.
While this is not the hip thing to do any more,
some of those mails are difficult to understand,
and I occasionally print them…
Intro 
 When I came back to the email account where I first subscribed to LKML,
it was full . 
 But if you are anyway using a local email client like mutt ,
there is a better option than subscribing via email:
The lei program lets you import Linux mailing list archives into local maildirs: 
 
 
 
 
 public-inbox at 
 lore.kernel.org 
 
 
 2.…
This is less of a “Today I learned” article, but more like a Unix
trick that took me too long to realize. 
 Create a new directory with a hello world C program: 
 $ ls
$ cat > hello.c
#include <stdio.h>

int main() {
 puts("Hello, world!");
 return 0;
}
 
 💡 The empty or non-existent Makefile is a valid makefile for this C
program:…

 
 ABI versions and matching access rights 
 
 The problem: Refer is different 
 
 Implementation of best-effort fallback in C 
 
 Common part: ABI version compatibility table 
 
 Case 1: the sandboxed program does not need to reparent files 
 
 Case 2: the sandboxed program needs to reparent files 
 
 Case 3: Sometimes this, sometimes that…
Linus Torvalds released Linux 6.2 yesterday, and this kernel release
supports restricting the truncate(2) and ftruncate(2) operations
with Landlock. (The kernel patch
set 
has more information and discussion.) 
 You can try this out today with the
 go-landlock library,
which already supports this feature. To forbid file truncation when
using go-landlock , update…

 
 Motivation 
 
 Philosophy 
 
 The Landlock approach 
 
 1. Make it really easy to use 
 
 2. Make sandboxing enablement part of program initialization 
 
 
 
 Other operating systems 
 
 Other Linux sandboxing technologies 
 
 
 
 How to use Go-Landlock 
 
 Step 1: Make sure your kernel supports Landlock…
So, there was a post by Justine Tunney 
about her port of OpenBSD’s
 pledge() to her own libc, the
 Cosmopolitan libc . 
 She is also calling out that previous attempts at this were flawed: 
 
 There’s been a few devs in the past who’ve tried this. I’m not going to name names, because most of these projects were never completed. […] The…
This explains how to configure multiple keyboards in Sway, and how to
use advanced configuration when regular xkb_options are not enough. 
 Sway configuration 
 Luckily, Sway has great support for multiple keyboards with different
layouts, so it nicely adjusts to whatever keyboard you have plugged in
or can use separate configurations for a physical keyboard and the
laptop…
This is a collection of interesting literature on the subject of error
handling which I had collected to research my own blog post on the
subject a while ago. 
 
 
 “ A Philosophy of Software
Design ”
by John Ousterhout has a significant section on error handling that
I found worth a read. It takes a slightly different angle and gives
some good…
Linux 5.13 is going to include the unprivileged sandboxing feature
Landlock, which has been in the making for many years now. 
 Unprivileged means that you don’t need special system-level
privileges like root or CAP_MAC_ADMIN to use it, as some other
Linux sandboxing mechanisms do. Philosophically speaking, you should
not need additional special privileges just to drop…
Tests should be correct by inspection 
Tests require a different approach than normal code. We don't have
tests for tests, so tests need to be correct by inspection -- and the
main technique to achieve this is to get rid of the generality of the
production code, and exercise only very narrow and specific scenarios.
 Decide what test to write 
 The goal of testing is to…
If your plan is to loop over a collection: You shouldn’t check for it being non-empty first. 
 Don’t do this: 
 if (!stuff.empty()) {
 for (Item item : stuff) {
 // ...
 }
}
 
 Do this instead: 
 for (Item item : stuff) {
 // ...
}
 
 Benefits: 
 
 Shorter 
 Less nesting 
 Same performance 
 
 I used to do this…
My toy Lisp fn is an inherently
single-threaded language, but with its built-in stack-inspection
capabilities, it’s easy to build coroutines on top. 
 The
 implementation 
only has about 20 lines of code, including comments. This article
contains a simplified implementation in-line. In only rewrote some
comments to make more sense in context, and removed…
Recently, almost all my digital drawings were made with a Bamboo
Slate 
tablet and Tuhi . It was good
fun to take Tuhi’s drawing data and create my own renderer
 tuhirender , which can be used
from the command line to produce some more advanced effects and tune
more of the rendering knobs. 
 tuhirender replaces Tuhi’s own renderer by building on…
In Go 1.14, the new T.Cleanup() 
function schedules defer-like work to be done after the current test.
This makes it possible to write very comfortable setup helper
functions: 
 func SetUpFrobnicator(t *testing.T) *frob.Frobnicator {
 t.Helper()

 f := frob.New() // Do setup.
 t.Cleanup(f.Close) // Schedule cleanup for later.
 return f
}

func…
The main technique in software design is this: You look at the
entirety of your system and you decompose it into pieces that are more
manageable and have clear interfaces. This approach is usually
referred to as modularization . 
 But what’s the point of investing such an effort if in the end only
the externally visible properties of a software matter? 
 In his…

 
 Renaissance gopher Johannes Gopherberg after inventing html/template 
 
 I’m using html/template much too seldom to remember how to
properly share common template blocks across multiple pages. Today I
had to figure it out for the second time. It’s about time to document
it! 
 The approach presented here both (1) makes it possible to…
A few weeks ago, I got myself a Bamboo
Slate 
tablet, and had a lot of fun playing around with the output. The Linux
software for talking to that device is
 Tuhi , which is GUI driven, but
also dumps the raw point and pressure data in JSON format into a
directory. 
 As a side effect of playing around with that, I published a 2d path
simplification library which uses…
Go’s lack of generics means that people can’t overengineer in the way
they are used to, so they need to put more thought into their designs. 
 There are some use cases where abstractions with generics are better
to the current ones (e.g. the sort package), but by and large, in
other languages, people use them to build towers of abstractions which
you’ll later…

 
 A fully automated cleanup strategy. 
 
 This is a comparison of different programming idioms for performing
cleanup work. 
 Common use cases where this is used include: 
 
 Locking and unlocking synchronization locks. 
 Opening and closing files. 
 Canceling asynchronous operations that aren’t needed any more. 
 Allocation and deallocation.…