Linux 系统误将 chmod 权限改成 了 000，如何恢复?

#include <sys/stat.h>

int main() {
    chmod("/usr/bin/chmod", 0755);
    return 0;
}

ubuntu@ubuntu:~$ which chmod
/usr/bin/chmod
ubuntu@ubuntu:~$ ls -lh /usr/bin/chmod
lrwxrwxrwx 1 root root 8 Sep 27  2025 /usr/bin/chmod -> gnuchmod
ubuntu@ubuntu:~$ ls -lh /usr/bin/gnuchmod
-rwxr-xr-x 1 root root 67K Jan 23 21:34 /usr/bin/gnuchmod
ubuntu@ubuntu:~$ sudo chmod 000 /usr/bin/chmod
ubuntu@ubuntu:~$ ls -lh /usr/bin/chmod
lrwxrwxrwx 1 root root 8 Sep 27  2025 /usr/bin/chmod -> gnuchmod
ubuntu@ubuntu:~$ ls -lh /usr/bin/gnuchmod
---------- 1 root root 67K Jan 23 21:34 /usr/bin/gnuchmod
ubuntu@ubuntu:~$ cat main.c
#include <sys/stat.h>

int main() {
    chmod("/usr/bin/chmod", 0755);
    return 0;
}

ubuntu@ubuntu:~$ gcc ./main.c
ubuntu@ubuntu:~$ sudo ./a.out
ubuntu@ubuntu:~$ ls -lh /usr/bin/chmod
lrwxrwxrwx 1 root root 8 Sep 27  2025 /usr/bin/chmod -> gnuchmod
ubuntu@ubuntu:~$ ls -lh /usr/bin/gnuchmod
-rwxr-xr-x 1 root root 67K Jan 23 21:34 /usr/bin/gnuchmod

Laptops all have built-in security tokens these days

macOS

https://github.com/yubico/libfido2

$ brew install libfido2

1. 建立 Secure Enclave 身份

建立一個受 Touch ID 保護的金鑰

sc_auth create-ctk-identity -l ssh -k p-256-ne -t bio

2. 產生 SSH Key

真正私鑰在 Secure Enclave 裡

ssh-keygen -w /usr/lib/ssh-keychain.dylib -K -N ""

id_ecdsa_sk_rk
id_ecdsa_sk_rk.pub

3. SSH 設定 ~/.ssh/config

Host *
  IdentityFile ~/.ssh/id_ecdsa_sk_rk
  SecurityKeyProvider=/usr/lib/ssh-keychain.dylib

4. 上傳 Public Key 或手動加入 ~/.ssh/authorized_keys

ssh-copy-id -i ~/.ssh/id_ecdsa_sk_rk.pub server

5. SSH 登入 Mac 會跳 Touch ID 驗證

ssh server

驗證成功才會使用私鑰簽章。

Git Commit Signing 額外步驟

直接指定 key 會失敗：

git config --global user.signingKey ~/.ssh/id_ecdsa_sk_rk
device not found

必須改成：

1. 加入 ssh-agent

ssh-add -K -S /usr/lib/ssh-keychain.dylib

2. Git 使用 Agent Key

[user]
    signingKey = "key::<pubkey>"

格式：

key:: + id_ecdsa_sk_rk.pub 內容

之後 git commmit會要求 Touch ID：

Windows

作者測試：

winget install Microsoft.OpenSSH.preview

ssh-keygen -t ecdsa-sk

之後 SSH 時：

  • Windows Hello
  • 臉部辨識
  • 指紋
  • PIN

Tailscale and RustDesk: Secure remote access to all your desktops

RustDesk Server(https://github.com/rustdesk/rustdesk-server)

https://rustdesk.com/docs/en/self-host/rustdesk-server-oss/docker/

services:
  hbbs:
    container_name: hbbs
    image: rustdesk/rustdesk-server:latest
    command: hbbs
    volumes:
      - ./data:/root
    network_mode: "host"

    depends_on:
      - hbbr
    restart: unless-stopped

  hbbr:
    container_name: hbbr
    image: rustdesk/rustdesk-server:latest
    command: hbbr
    volumes:
      - ./data:/root
    network_mode: "host"
    restart: unless-stopped
  • hbbs:
    • 21114 (TCP): used for web console, only available in Pro version.
    • 21115 (TCP): used for the NAT type test.
    • 21116 (TCP/UDP): Please note that 21116 should be enabled both for TCP and UDP. 21116/UDP is used for the ID registration and heartbeat service. 21116/TCP is used for TCP hole punching and connection service.
    • 21118 (TCP): used to support web clients.
  • hbbr: 21117 (TCP): used for the Relay services. 21119 (TCP): used to support web clients.

After the server is running, clients usually need the ID Server address and the server public Key. The key is usually generated on the first run of hbbs and can be found in the file id_ed25519.pub in your working directory /data folder.

RustDesk Client(https://github.com/rustdesk/rustdesk)

Docker

docker run -d \
  --name rustdesk-client \
  -p 6901:6901 \
  -e VNC_PW=password \
  rustdesk/rustdesk:latest

Settings -> Security -> Enable direct IP access

Unexpected security footguns in Go’s parsers

  1. Implement strict parsing by default. Use DisallowUnknownFields for JSON, KnownFields(true) for YAML. Unfortunately, this is all you can do directly with the Go parser APIs.
  2. Maintain consistency across boundaries. When input in processed in multiple services, ensure consistent parsing behavior by always using the same parser or implement additional validation layers, such as the strictJSONParse function shown above.
  3. Watch for JSON v2.
  4. Leverage static analysis. Use the Semgrep rules we’ve provided to detect a few vulnerable patterns in your codebase, particularly the misuse of the - tag and omitempty fields. Try them with semgrep -c r/trailofbits.go.unmarshal_tag_is_dash.unmarshal-tag-is-dash and semgrep -c r/trailofbits.go.unmarshal_tag_is_omitempty.unmarshal-tag-is-omitempty!