Inside OpenPLC Runtime v4: Establishing a Security Research Baseline

说明与用途

建立了 OpenPLC Runtime v4 的运行环境基线，记录了进程、套接字、网络接口和权限，为后续安全研究奠定基础。

问题

Understand the runtime environment of OpenPLC Runtime v4 before conducting deeper security tests.

结果

A comprehensive baseline of OpenPLC Runtime v4’s runtime processes, communication interfaces, Linux environment, and recovery behavior was established, providing a reference for future security investigations.

工作流

• 1. Start Docker container with image ghcr.io/autonomy-logic/openplc-runtime:latest and publish ports 8443 and 502.
• 2. Inspect /proc, /sys, and filesystem to list processes, threads, and executable paths.
• 3. Record process names, PIDs, and thread counts.
• 4. Terminate plc_main to observe supervisor recovery and state transition.
• 5. Enumerate local Unix-domain sockets and their paths.
• 6. Use ss to list network listeners inside container.
• 7. Check file permissions, ownership, and modes for executables and runtime files.
• 8. Inspect Linux capabilities of processes.
• 9. Review open file descriptors and device nodes in /dev.

证据

I started the container with the runtime image and published ports for the web interface and Modbus TCP:

来源

The container's initial process, PID 1, ran the Python web management application through its virtual environment.

来源

I then deliberately terminated plc_main to observe what happened. The supervisor reported an unexpected exit with code -9 and attempted to restart the process.

来源

I used ss to inspect the network sockets visible inside the container's network namespace.

来源