3 ms·
If io_uring wouldn't be such a success story, security researchers wouldn't need to worry about it so much. So I guess the order of things happening is not that
by xiphias2 5y ago
If io_uring wouldn't be such a success story, security researchers wouldn't need to worry about it so much. So I guess the order of things happening is not that big of a problem.
- wyldfire 5y agoI don't know if I agree. An attacker may be able to craft a call to io_uring_{setup,enter,etc} even if no call exists in the program under attack. And if io_uring is poorly designed it could result in a privilege escalation or other bad things. I suppose if it were a completely uninteresting feature it wouldn't end up enabled in most distros' kernel configs.
- kevincox 5y agoAudit logs don't need to be complete to be useful. You can still investigate a wide range of issues in applications that are only (or primarily) using audited APIs. Of course they are more useful if they are complete, but it isn't the only use case.