Linux
Linux ExecUnits use native shared libraries and filesystem-based local communication. Commands and listeners share these platform constraints while retaining separate application roles.
Supported combinations
The current commercial Linux agent targets x86_64 and supports native Executable and Linkable Format (ELF) shared objects in its own process, called the self context.
| Component | Available Linux artifacts | Coverage |
|---|---|---|
| Default command ExecUnits | Native ELF shared objects | A subset of the Windows command catalog |
| Simple Hypertext Transfer Protocol (HTTP), Transmission Control Protocol (TCP), and Domain Name System (DNS) listeners | Native ELF shared objects | All three families |
| TCP bind and TCP reverse listeners | Native ELF shared objects | Both families |
| TCP listener-owned commands | Native ELF shared objects | Both corresponding command families |
| Server Message Block (SMB) listener and its owned command | None | Windows-only |
The current Linux execution path does not provide the Windows managed or shellcode format families, or the Windows new-process and existing-process contexts. Agent support and plugin artifact availability must both match.
Loading model
Linux compatibility includes processor architecture, the C/C++ runtime, and any dynamic dependencies of the particular artifact. A shared object built for FreeBSD is not a Linux shared object merely because both use ELF.
The current agent and default component builds use an Ubuntu 18.04-based Linux build environment. Treat that as a build baseline rather than a guarantee for every distribution: dependency requirements still belong to each artifact, and components need validation together on the intended operating system.
Local communication
The standard Linux channel uses two filesystem first-in, first-out (FIFO) endpoints, with one direction per endpoint. Together they provide bidirectional local communication, unlike the single duplex named-pipe connection used on Windows.
See the FIFO model for filesystem endpoint responsibilities and Stream Behavior for the distinction between byte streams and application messages.
Lifetime and limitations
The current Linux context provides no process separation between the agent and its ExecUnits. Assess component-specific constraints using command limitations and listener limitations. See Ownership and Disconnection for cleanup of FIFO endpoints.