Larvitz Blog
Mastodon

Welcome to Larvitz Blog! I’m Christian, a Senior Consultant by day and FreeBSD enthusiast by night, with over 20 years in enterprise IT. Here I write about FreeBSD jails, PF firewalling, self-hosting, Linux system administration, and anything that’s cleanly engineered. Most articles are hands-on guides born from running my own infrastructure, from dual-stack networking and Ansible automation to hosting a Mastodon instance on FreeBSD.

Have a question or want to discuss something? Find me on the Fediverse at @Larvitz@burningboard.net. I’m always happy to chat!

#security Articles

  • Sun 08 November 2026
  • Linux

A Read-Only AI Reviewer for Forgejo Pull Requests

A small Python service that reviews every pull request on my self-hosted Forgejo with an LLM, posts a summary and inline findings, and is not allowed to do anything else. The interesting part was not getting a model to comment on a diff. It was getting it to stop being confidently wrong about code it had never seen, and making sure a misbehaving or manipulated bot could not change a single line.

Hardware Keys Without GnuPG: The Rust OpenPGP Card Stack, Now in FreeBSD Ports

Three small Rust tools from the OpenPGP Card project replace the GnuPG stack for my everyday hardware key work: oct to manage OpenPGP cards and Nitrokeys, oct-git to sign Git commits, and openpgp-card-ssh-agent as a hardware-backed SSH agent. I ported all three to FreeBSD and they are now in the ports tree. This article explains what each tool does, how they share PIN handling, and how I set them up on Fedora and on my FreeBSD T480.

php2shell on arm64: Building Fixed PHP Packages Without Poudriere

The php2shell fix landed in the FreeBSD ports tree within a day, but packages had only been built for some CPU architectures, and my arm64 jail host was not among them. Instead of setting up Poudriere for a one-off job, I built the fixed PHP 8.5.12 in a throwaway Bastille jail, turned the result into a tiny local pkg repository and upgraded the affected jails from it.

My Ansible Plugin Had a Jail Escape: CVE-2026-55074

For almost a year, my jailexec connection plugin let a compromised FreeBSD jail redirect a root-owned write onto the jail host. The input validation was fine. The problem was on which side of the jail boundary the paths were resolved. This is the story of the bug, the fix in 2.0.0, and the CVE that came with it.

FreeBSD Foundationals: The Boot Process - From the Loader to Boot Environments

The third in the FreeBSD Foundationals series. This one covers how FreeBSD actually boots: the stages from power-on to login, BIOS vs UEFI, the loader and loader.conf, the difference between read-only tunables and runtime sysctls, the modern way to load kernel modules with kld_list, managing it all safely with sysrc, a practical security-hardening baseline, and - the headline act - boot environments with bectl, the undo button that turns a broken upgrade into a thirty-second reboot.

mdo on FreeBSD 15: Base-System Privilege Delegation with mac_do

FreeBSD 15 ships mdo(1) and the mac_do(4) policy module in the base system. It replaces sudo and doas for most of my hosts, needs no ports, and configures with a single sysctl. This article walks through enabling it, the rule syntax, a few real examples, and a short detour into the security sysctls I run on every box.

Fedora Hummingbird: Distroless, Container-Native Linux and a Slim mastogreet

Fedora Hummingbird brings the distroless container model to a full, image-based rolling operating system, and it ships a catalog of hardened language images alongside it. I rebuild the mastogreet bot’s Containerfile on top of registry.access.redhat.com/hi/python to see what changes, what shrinks, and where the commercial Red Hat Hardened Images downstream fits in.