Inside the PLC Runtime: What OpenPLC v4 Reveals About Its Linux Environment

The OpenPLC Runtime v4 is a runtime environment for industrial control logic. It operates within a Linux environment, interacting with various processes, communication interfaces, and system resources. To understand its behavior better, I conducted a series of investigations starting with a baseline assessment.

The runtime consists of multiple processes running inside a Docker container. The Python web management application spawns an initial process (PID 1) and a separate process named "etherdog" for runtime supervision. The PLC execution process is identified as "plc_main". These processes all have multiple threads, indicating they are not single-threaded.

Upon termination of the "plc_main" process, the runtime supervisor attempted to restart it. However, the replacement process failed to locate necessary library files, resulting in an "EMPTY" state. This observation provides insight into the runtime's recovery behavior under unexpected component exits.

In terms of local communication, the runtime uses Unix-domain sockets for internal messaging. The web application communicates via /run/runtime/plc_runtime.socket, while the UnixLogServer handles log messages through /run/runtime/log_runtime.socket. The supervisor uses /run/runtime/etherdog.socket for control purposes. These communication interfaces are integral to the runtime's design, though their authorization behavior remains outside the scope of this investigation.

Network listeners within the container show two bound sockets associated with the Python management process. One listens on TCP port 8443, and the other on UDP port 33333. However, despite Docker port publishing for TCP port 502, no Modbus TCP listener was detected on that port. This discrepancy highlights the importance of considering additional network conditions influencing service reachability.

In summary, OpenPLC Runtime v4 runs within a Linux environment, featuring multiple processes, local communication channels using Unix-domain sockets, and network listeners. Understanding these elements is crucial for comprehensive PLC security investigations.