3 ms·
I don't know if I agree. An attacker may be able to craft a call to io_uring_{setup,enter,etc} even if no call exists in the program under attack. And if io_u
by wyldfire 5y ago
I don't know if I agree. An attacker may be able to craft a call to io_uring_{setup,enter,etc} even if no call exists in the program under attack. And if io_uring is poorly designed it could result in a privilege escalation or other bad things.
I suppose if it were a completely uninteresting feature it wouldn't end up enabled in most distros' kernel configs.
- kevincox 5y agoAudit logs don't need to be complete to be useful. You can still investigate a wide range of issues in applications that are only (or primarily) using audited APIs. Of course they are more useful if they are complete, but it isn't the only use case.