# sigma star gmbh

> sigma star gmbh is an IT consulting company in Innsbruck, Austria. We specialize in
> embedded Linux, Linux kernel engineering, IT security, and cryptography. We offer
> security audits, penetration testing, software engineering, and hands-on technical
> trainings on topics such as Yocto, Linux kernel internals, secure coding, and SELinux.
> Contact: office@sigma-star.at

The site is bilingual (English and German). English content lives at the root,
German content under /de/. The blog is English only.

## Services

- [Security Services](https://sigma-star.at/security/): Source code audits, cryptography, penetration testing, and Linux hardening from senior security engineers. Technical resilience for NIS2 and the EU Cyber Resilience Act.
- [Engineering Services](https://sigma-star.at/engineering/): Full-spectrum Linux engineering from senior kernel maintainers: drivers and bootloaders, real-time (PREEMPT_RT & Xenomai), embedded Linux and BSPs, filesystems, and security by design.
- [Training Services](https://sigma-star.at/training/): High-impact Linux and security training delivered by senior engineers and active kernel maintainers. Embedded Linux, Yocto, OS hardening, and secure coding, as standard or customized modules.
- [About sigma star](https://sigma-star.at/about/): Who is sigma star? How long have the three team members been working together? And what drives them? Find out more about the team now.

## Trainings

- [Building Embedded Linux Systems with Yocto](https://sigma-star.at/trainings/building-embedded-linux-systems-with-yocto/): Master Yocto for embedded Linux in this hands-on workshop for developers. Build, customize & optimize systems with practical examples, focusing on a Raspberry Pi.
- [C/C++ Secure Coding](https://sigma-star.at/trainings/secure-coding-with-c-and-cpp/): Get to know C and C++ and learn how to apply them in a secure way! This training focuses on practical learning with many examples, tips from the field, and best practices.
- [Code Review Training](https://sigma-star.at/trainings/code-review/): Master code review! Learn effective techniques, foster constructive communication, and elevate your coding standards. Join us to enhance your skills and teamwork.
- [Embedded Linux Hardening and Firmware Security](https://sigma-star.at/trainings/hardening-embedded-linux-systems/): Master embedded systems security with this training, providing a good mix of theory and hands-on. Learn to tackle pitfalls and implement robust protections!
- [Kernel Internals for Linux Admins](https://sigma-star.at/trainings/kernel-internals-for-linux-admins/): Make your troubleshooting more efficient: Gain valuable techniques and learn to analyze Linux runtime behavior better. Even interesting for experienced admins!
- [Kubernetes Security Training](https://sigma-star.at/trainings/k8s-kubernetes-security/): Kubernetes features are numerous, let's secure them! Get to know key security aspects through hands-on examples and best practices: For safe Kubernetes deployments.
- [SELinux: Security Enhanced Linux](https://sigma-star.at/trainings/selinux-security-enhanced-linux/): Increase your Linux security skills! Learn to harden Linux systems, debug issues, and create custom policies. We provide you with the essential skills for SELinux.
- [Source Code Management with git](https://sigma-star.at/trainings/source-code-management-with-git/): Optimize your workflows and gain expert insights: We teach you essential commands and advanced features to effectively manage software projects with git.

## Blog

- [Integrity on Embedded Linux Devices under the Cyber Resilience Act](https://sigma-star.at/blog/2026/06/integrity-on-embedded-linux-devices-under-the-cyber-resilience-act/): What the CRA integrity requirement means in practice for embedded Linux devices. (2026-06-29)
- [TrustZone Intermezzo: Broken OP-TEE Memory Isolation on i.MX 8M](https://sigma-star.at/blog/2026/06/trustzone-intermezzo/): A commit enabling the TZASC on NXP i.MX 8M sent us down a rabbit hole: how a DDR memory alias bypasses Arm TrustZone and exposes OP-TEE's secure memory to Linux. (2026-06-11)
- [You probably don't need Yocto, and that's fine](https://sigma-star.at/blog/2026/05/you-probably-dont-need-yocto-and-thats-fine/): Yocto is powerful, but for many embedded Linux projects it's overkill. Here's when to use it, when to skip it, and what to use instead. (2026-05-26)
- [Data Confidentiality via Storage Encryption on Embedded Linux Devices](https://sigma-star.at/blog/2026/02/data-confidentiality-via-storage-encryption-on-embedded-linux-devices/): An overview of storage-encryption options in Linux. (2026-02-24)
- [TPM on Embedded Systems: Pitfalls and Caveats](https://sigma-star.at/blog/2026/01/tpm-on-embedded-systems-pitfalls-and-caveats/): This Blog Post Outlines Common Pitfalls and Caveats when Integrating a TPM (2026-01-19)
- [Fixing a Buffer Overflow in UNIX v4 Like It's 1973](https://sigma-star.at/blog/2025/12/unix-v4-buffer-overflow/): This blog post shows how to fix a buffer overflow in the su progam of UNIX v4 (2025-12-31)
- [The Evolving Landscape of Yocto Project Setup: bitbake-setup vs. KAS](https://sigma-star.at/blog/2025/10/the-evolving-landscape-of-yocto-project-setup-bitbake-setup-vs.-kas/): The Yocto Project's new official tool, bitbake-setup, is now available, offering an alternative to the established KAS tool for project setup. This post compares the critical differences in features, configuration, and philosophy to clarify the current state and future of Yocto builds. (2025-10-28)
- [Deep Down the Rabbit Hole: Bash, OverlayFS, and a 30-Year-Old Surprise](https://sigma-star.at/blog/2025/06/deep-down-the-rabbit-hole-bash-overlayfs-and-a-30-year-old-surprise/): This blog post describes a recent debugging session that led through a surprising set of issues involving Bash, `getcwd()`, and OverlayFS. What started as a simple customer bug report turned into a deep dive worth sharing. (2025-06-24)
- [Filesystem Vulnerabilities in Bootloaders: A Hidden Risk for Verified Boot Mechanisms](https://sigma-star.at/blog/2025/01/filesystem-vulnerabilities-in-bootloaders-a-hidden-risk-for-verified-boot-mechanisms/): Filesystem vulnerabilities in bootloaders like U-Boot and Barebox represent a critical yet often overlooked risk to the verified boot process in Linux-embedded IoT systems. While verified boot mechanisms authenticate file contents, weaknesses in the handling of filesystem metadata can enable attackers to bypass the chain of trust, exposing devices to arbitrary code execution and compromising system security. (2025-01-27)
- [sigma-star-sa-2024-001: CHAP authentication bypass in user-space Linux target framework (tgt) up to v1.0.92 (CVE-2024-45751)](https://sigma-star.at/blog/2024/09/sigma-star-sa-2024-001/): The user-space iSCSI target daemon of the Linux target framework (tgt) uses an insecure random number generator to generate CHAP authentication callenges. This results in predictable challenges which an attacker capable of recording network traffic between iSCSI target and initiator can abuse to bypass CHAP authentication by replaying previous responses. (2024-09-07)
- [Thoughts on Linux CNA's Approach and the Resulting CVE Flood](https://sigma-star.at/blog/2024/03/linux-kernel-cna/): Recently, the Linux Kernel Project attained the status of a CNA (CVE Numbering Authority), granting it the capability to independently issue CVEs (Common Vulnerabilities and Exposures). While this development may not appear groundbreaking on its own, the substantial increase in the number of newly assigned CVEs has captured the attention of many individuals. I've received numerous inquiries from people seeking clarification on the situation surrounding the Linux CNA and expressing concern about the apparent surge in the issuance of CVE numbers for almost every non-trivial patch applied to the maintained stable kernel trees. (2024-03-13)
- [Pseudo Graceful Process Termination through Code Injection](https://sigma-star.at/blog/2024/02/exit0-code-injection/): This blog post outlines the utilization of code injection to create a tool capable of gracefully terminating any program, setting its exit code to 0. (2024-02-25)
- [A Time Consuming Pitfall for 32-bit Applications on AArch64](https://sigma-star.at/blog/2024/02/aarch64-32-bit-compat-pitfall/): When running legacy applications on AArch64, an interesting pitfall can arise. (2024-02-14)
- [Investigating Paranormal Shell Activities](https://sigma-star.at/blog/2023/11/paranormal-shell-activities/): Recently, while attending a conference, I observed an unusual occurrence in my terminal emulator: terminal tab windows were getting highlighted without any apparent notification within the shell session. Time to unpack our trusty debugging tools to uncover the mystery of these activities. (2023-11-17)
- [Analyzing Packet Drops Without Tooling: Or ftrace the Pure Way](https://sigma-star.at/blog/2023/11/ftrace-skb-drop/): Linux offers a lot of tools to understand internals, today we'll analyze the network stack with zero tools installed. (2023-11-02)
- [No Love for Negative Permissions](https://sigma-star.at/blog/2023/08/no-love-for-negative-permissions/): Negative permissions have always been bad practice, with the help of container tooling they can be bypassed too. (2023-08-31)
- [CVE-2023-31147: Insufficient randomness for DNS query identifiers in c-ares](https://sigma-star.at/blog/2023/08/c-ares_cve-2023-31147/): We've been part of a team that audited c-ares. This is a writeup of how we discovered that DNS query identifiers generated by c-ares are not always properly random which lead to CVE-2023-31147. (2023-08-22)
- [Let's Embed a Go Program into the Linux Kernel](https://sigma-star.at/blog/2023/07/embedded-go-prog/): Today, we would like to present a lesser-known feature of the Linux kernel. Instead of launching a program from a file system, regardless of whether it's virtual or not, it is also possible to embed a user-space program directly into the kernel image itself and start it from there. (2023-07-21)
- [Embedded Open Source Summit 2023 in Prague](https://sigma-star.at/blog/2023/07/eoss-2023/): The Embedded Open Source Summit in Prague offered valuable insights and connections for our company, focusing on Linux and security, as our first major conference since the pandemic. (2023-07-03)
- [Who's your canary?](https://sigma-star.at/blog/2023/05/stack-canary/): Stack canaries are a common security feature to mitigate buffer-overflows. However, it's value is generated differently in every libc-implementation, which has security implications. (2023-05-30)
- [Restricting network access using Linux Network Namespaces](https://sigma-star.at/blog/2023/05/sandbox-netns/): Our last blog post on Linux mount namespaces explored ways to restrict access to the file system. In this post we'll show how to restrict access to the network. (2023-05-07)
- [Too many CPUs to build](https://sigma-star.at/blog/2023/04/too-many-cpus/): Lately we've been facing strange build errors on one of our build servers. The root cause was quite surprising. (2023-04-09)
- [Restricting file system access using Linux Mount Namespaces](https://sigma-star.at/blog/2023/03/sandbox-mountns/): Linux offers a variety of mechanisms to confine a process, one of them are namespaces. Today they are mostly used as foundation for Linux containers. In this blog post we'll demonstrate how namespaces can be used to restrict access to the file system for a given process and all its children. (2023-03-18)
- [Training: Kernel Internals for Linux Admins](https://sigma-star.at/blog/2022/12/linux-internals-training/): Understanding certain kernel internals is not only useful for persons that intend developing kernel related software. (2022-12-13)
- [Securely booting x86 using Heads](https://sigma-star.at/blog/2022/11/securely-booting-x86-heads/): An overview about x86 firmware security and Heads, a project aiming to gain more trust in the boot process. (2022-11-10)
- [Alpine Linux Persistence and Storage Summit 2022](https://sigma-star.at/blog/2022/10/alpss-2022/): ALPSS 2022 took place again and here's what happened (2022-10-23)
- [EROFS vs. SquashFS: A Gentle Benchmark](https://sigma-star.at/blog/2022/07/squashfs-erofs/): This blog post gives an overview of EROFS vs. SquashFS and tries to compare them with a simple benchmark. (2022-07-21)
- [Our ProtonMail Adventure - A Five Act Drama](https://sigma-star.at/blog/2022/07/protonmail-adventure/): In 2021 we switched to ProtonMail and figured the hard way that it is not the right thing for us. (2022-07-01)
- [Summit on a Summit 2022 Edition](https://sigma-star.at/blog/2022/06/summit-summit-2022/): After a two years long break the Summit on a Summit was back in early June this year. (2022-06-13)
- [Linux process priorities demystified](https://sigma-star.at/blog/2022/02/linux-proc-prios/): Simple questions often have not so simple answers. One example is the question is, what priority does this process have? (2022-02-02)
- [Re-exploiting unsquashfs](https://sigma-star.at/blog/2022/01/re-exploiting-unsquashfs/): Squashfs-tools recently fixed a security issue. In this blog post we show how to re-exploit it and how it got mitigated (2022-01-10)
- [Alpine Linux Persistence and Storage Summit 2021](https://sigma-star.at/blog/2021/11/alpss-2021/): ALPSS was back in 2021 and here's what happened :-) (2021-11-20)
- [How security-integration for IT Startups works best](https://sigma-star.at/blog/2021/09/security-for-startups/): If Startups invest  money into security right from the scratch, the costs will be much lower in the end. Why? Read this article! (2021-09-14)
- [Enhanced Read-Only File System (EROFS) lands in Yocto](https://sigma-star.at/blog/2021/09/yocto-erofs/): The upcoming Yocto 3.4 release will contain a small contribution by us. Over the last two years we learned to love EROFS, so we decided to add support for it to Yocto. (2021-09-09)
- [Docker to the rescue in an unexpected way](https://sigma-star.at/blog/2021/08/docker-embedded-rootfs/): Imagine you find yourself in a restricted environment and you need some Linux rootfs that runs on the embedded system you just managed get access to. Of course the CPU architecture of the embedded system is not the same as your workstation. The circumstances are further complicated by the fact that the userspace should offer enough tooling to build a C/C++ application. In such a situation docker can help, but in an unexpected way. (2021-08-10)
- [The condemned live longer: Symlink races](https://sigma-star.at/blog/2021/07/docker_cve-2018-15664/): In this blog post we will take a closer look at a symlink race vulnerability from 2018 in docker. We think the vulnerability is quite interesting since it is easy to exploit but not so obvious to find while reviewing. Attentive readers may ask themselves whether they’d have noticed the issue while developing or reviewing the affected lines of code. (2021-07-30)
- [Who is sigma star und who is the team](https://sigma-star.at/blog/2021/06/who-we-are/): Presenting what sigma star is doing and who is the team of sigma star. (2021-06-01)

## Optional

- [Full site content as one plain-text file](https://sigma-star.at/llms-full.txt)
- [Full-content blog RSS feed](https://sigma-star.at/blog/index.xml)
- [German version of the site](https://sigma-star.at/de/)