# log.0x21.biz (oxzi)

oxzi writes at log.0x21.biz, mostly systems and security engineering with a Go slant. The posts tend to take an OS security primitive that has a reputation for being fiddly — seccomp filters, pledge/unveil, Landlock — and show it working as a short, concrete Go snippet against `golang.org/x/sys/unix`, rather than describing it in the abstract.

The practical side shows up in the tooling too. oxzi wrote [`syscallset-go`](https://github.com/oxzi/syscallset-go), which ports systemd's `SystemCallFilter` group syntax (`@system-service`, `@basic-io`) on top of elastic's go-seccomp-bpf, so a Go program can restrict its syscalls with a pledge-like one-liner instead of hand-authoring a BPF program. Example code for the privilege-dropping material lives in a separate showcase repo at codeberg.org/oxzi/go-privsep-showcase.

## Ingested articles

- [[go-privilege-dropping]] — self-restricting a Go program at startup with chroot, setrlimit, pledge/unveil, seccomp, and Landlock