log.0x21.biz (oxzi)
- title
- log.0x21.biz (oxzi)
- type
- entity
- summary
- oxzi's blog — systems and security writeups in Go, OpenBSD/Linux sandboxing primitives; author of syscallset-go
- tags
- blog, person, security, go
- created
- 2026-07-21
- updated
- 2026-07-21
oxzi writes at log.0x21.biz, mostly systems and security engineering with a Go slant. The posts tend to take an OS security primitive that has a reputation for being fiddly — seccomp filters, pledge/unveil, Landlock — and show it working as a short, concrete Go snippet against golang.org/x/sys/unix, rather than describing it in the abstract.
The practical side shows up in the tooling too. oxzi wrote syscallset-go, which ports systemd's SystemCallFilter group syntax (@system-service, @basic-io) on top of elastic's go-seccomp-bpf, so a Go program can restrict its syscalls with a pledge-like one-liner instead of hand-authoring a BPF program. Example code for the privilege-dropping material lives in a separate showcase repo at codeberg.org/oxzi/go-privsep-showcase.
Ingested articles
- go-privilege-dropping — self-restricting a Go program at startup with chroot, setrlimit, pledge/unveil, seccomp, and Landlock