this post was submitted on 25 Jun 2026
51 points (98.1% liked)

Linux

14168 readers
414 users here now

A community for everything relating to the GNU/Linux operating system (except the memes!)

Also, check out:

Original icon base courtesy of lewing@isc.tamu.edu and The GIMP

founded 3 years ago
MODERATORS
Ategon@programming.dev
anzo@programming.dev
dwraf_of_ignorance@programming.dev
51
File canary kill switch (gitlab.com)
submitted 1 week ago by lemmyuser@programming.dev to c/linux@programming.dev
14 comments fedilink hide all child comments
 

I wrote a dead simple file canary tool that will install an eBPF program that drops all outgoing packets if a canary is touched. I wrote this in response to the current trend of supply chain attacks that try to harvest credentials

you are viewing a single comment's thread
view the rest of the comments
[–] MonkderVierte@lemmy.zip 2 points 1 week ago (1 children)

This should definitely not be run on a server unless you really know what you're doing. You will lose all connectivity and you will never be able to get it back by normal means!

[–] BetterDev@programming.dev 3 points 1 week ago (1 children)

Uh yeah, that's the whole idea. I can always just bring it offline and mount the root as a separate disk to a different VM to investigate.

[–] BetterDev@programming.dev 1 points 1 week ago (1 children)

Or even just log in via serial console, but that's not a capability I have coded in yet.

[–] BetterDev@programming.dev 2 points 1 week ago

I guess what I'm saying is I match the "really know what you're doing" criteria.