<?xml version="1.0" encoding="utf-8" standalone="yes"?>
<rss version="2.0" xmlns:atom="http://www.w3.org/2005/Atom">
  <channel>
    <title>rce on HardenedLinux</title>
    <link>https://hardenedlinux.org/tags/rce/</link>
    <description>Recent content in rce on HardenedLinux</description>
    <generator>Hugo -- gohugo.io</generator>
    <language>en-us</language>
    <lastBuildDate>Mon, 13 Apr 2026 00:00:00 +0000</lastBuildDate><atom:link href="https://hardenedlinux.org/tags/rce/index.xml" rel="self" type="application/rss+xml" />
    <item>
      <title>Stealthy RCE on Hardened Linux: noexec &#43; Userland Execution PoC</title>
      <link>https://hardenedlinux.org/blog/2026-04-13-stealthy-rce-on-hardened-linux-noexec--userland-execution-poc/</link>
      <pubDate>Mon, 13 Apr 2026 00:00:00 +0000</pubDate>
      
      <guid>https://hardenedlinux.org/blog/2026-04-13-stealthy-rce-on-hardened-linux-noexec--userland-execution-poc/</guid>
      <description>Running arbitrary ELFs on noexec,nosuid,nodev mounts &amp;ndash; without ever whispering execve(2) to the kernel.
A straight-from-the-underground deep dive into the userland-exec toolkit. We built it. We drop it. We own the box.
The Radical Threat Model (because “defense in depth” is just marketing until you test it) Sysadmins think they’ve won when they slap this on:
mount -t tmpfs -o noexec,nosuid,nodev tmpfs /tmp/noexec_demo Add SELinux enforcing or a tight AppArmor profile and they call it a day.</description>
    </item>
    
  </channel>
</rss>
