Inside OpenPLC Runtime v4: Establishing a Security Research Baseline

Description and use

A baseline of OpenPLC Runtime v4’s execution environment was created, detailing processes, sockets, network interfaces, and privileges, providing a foundation for subsequent security research.

Problem

Understand the runtime environment of OpenPLC Runtime v4 before conducting deeper security tests.

Outcome

A comprehensive baseline of OpenPLC Runtime v4’s runtime processes, communication interfaces, Linux environment, and recovery behavior was established, providing a reference for future security investigations.

Workflow

• 1. Start Docker container with image ghcr.io/autonomy-logic/openplc-runtime:latest and publish ports 8443 and 502.
• 2. Inspect /proc, /sys, and filesystem to list processes, threads, and executable paths.
• 3. Record process names, PIDs, and thread counts.
• 4. Terminate plc_main to observe supervisor recovery and state transition.
• 5. Enumerate local Unix-domain sockets and their paths.
• 6. Use ss to list network listeners inside container.
• 7. Check file permissions, ownership, and modes for executables and runtime files.
• 8. Inspect Linux capabilities of processes.
• 9. Review open file descriptors and device nodes in /dev.

Evidence

I started the container with the runtime image and published ports for the web interface and Modbus TCP:

Source

The container's initial process, PID 1, ran the Python web management application through its virtual environment.

Source

I then deliberately terminated plc_main to observe what happened. The supervisor reported an unexpected exit with code -9 and attempted to restart the process.

Source

I used ss to inspect the network sockets visible inside the container's network namespace.

Source