Electing the creator of a POSIX shared-memory object does not mean the object is ready for another process to use. A successful exclusive shm_open can publish a name while its length is still zero and its synchronization objects are uninitialized. Separate creation, sizing, initialization and readiness publication, and require attachers to pass each boundary before…
When pthread_mutex_lock returns EOWNERDEAD for a robust mutex, the caller has acquired the lock and must reconcile the protected data before declaring it consistent. Calling pthread_mutex_consistent is an acknowledgment of completed repair, not the repair itself. If the invariant cannot be restored, keep ordinary consumers out and follow an explicit unrecoverable-state policy. This guide uses…
Qualify POSIX message queues through the actual mq API, effective limits and IPC namespace before blaming a missing /dev/mqueue directory. The filesystem mount is an inspection view; it is not the queue’s API name. A service also needs a lifecycle for persistent queue names, compatible attributes and cleanup after failed startup. This guide uses Linux…
Read back SO_RCVBUF and SO_SNDBUF after setting them, then qualify the real traffic path. On Linux the requested value can be capped, is doubled for internal accounting and is subject to a minimum. A successful setsockopt call therefore does not prove that the requested payload capacity was installed or that the receiver can survive the…
At EMFILE, stop admitting work that needs new descriptors and preserve diagnostics through resources already open. Identify whether the exhausted resource is the process’s descriptor table, the system-wide open-file pool or another allocation path before changing limits. A larger descriptor limit can postpone a leak while leaving the same failure mechanism intact. This guide uses…
Qualify large-file support at every boundary that carries a file offset or size, including library interfaces and intermediate arithmetic. On a 32-bit glibc build, selecting _FILE_OFFSET_BITS=64 can widen the relevant interfaces, but it cannot repair an already compiled narrow library or an application field that still truncates the value to int. This guide uses Linux…
After IN_Q_OVERFLOW, treat the affected inotify instance’s incremental view as incomplete and rebuild it from authoritative filesystem state. Continuing to apply later events cannot reconstruct the missing changes. A configuration service should enter a visible reconciliation state, repair its watches and validate a complete candidate configuration before publishing a new in-memory generation. This guide follows…
Set close-on-exec when a descriptor is created, duplicated or received, unless it belongs to an explicit helper-inheritance contract. Adding FD_CLOEXEC later with fcntl leaves a multithreaded fork/exec window. A helper can retain a device port, socket or pipe after the parent closes its copy, preventing the release the service expected. This guide follows Linux man-pages…
Use discard advice only when the application has explicitly surrendered the affected pages’ contents or can reconstruct them under the mapping’s contract. Linux MADV_DONTNEED can change what later reads return. A successful call is not a promise to preserve a live buffer while merely making its RAM accounting smaller. This guide uses Linux man-pages 6.12…
Authenticate a local socket client using kernel-supplied credentials at the boundary your authorization policy actually needs. SO_PEERCRED supplies a connection-related snapshot; it is not a continuously refreshed statement about whoever currently writes each byte. If authority must follow each message, evaluate message credentials and an explicit protocol instead of assuming a connected descriptor permanently identifies…