linux-internals

Deep Linux internals for practitioners who need to reason below libc and framework abstractions.

This skill is for structural mechanics: what the kernel and loader actually do, what invariants hold, what breaks across versions, and where detection surfaces appear.

When to activate

• You are writing or reviewing custom ELF loaders, in-memory execution, or reflective mapping logic
• You are diagnosing execution before main or checking an old startup diagram against the target libc and toolchain
• You are parsing /proc for process, memory, mount, or namespace intelligence and need race-safe interpretation
• You are building namespace or container boundary logic with clone, unshare, setns, or pidfd flows
• You are loading eBPF programs and debugging verifier failures, helper constraints, map lifetime, or attach semantics
• You are reasoning about LSM policy behavior, hook order, and process security attribute surfaces
• You need to explain detection and hardening implications of low-level Linux behavior

If the task is ordinary userland API usage, this skill is overkill. If the task is ABI and kernel boundary mechanics, use this skill first.