3 ms·
seccomp filters generally are whitelists. If they haven't whitelisted io_uring_setup it's a non-issue. They only suffer the performance consequences of userspac
by the8472 4y ago
seccomp filters generally are whitelists. If they haven't whitelisted io_uring_setup it's a non-issue. They only suffer the performance consequences of userspace having to use the synchronous syscalls.
also, iouring doesn't allow arbitrary syscalls. so it's not really a complete seccomp bypass even when allowed
- ori_b 4y ago> They only suffer the performance consequences of userspace having to use the synchronous syscalls. And the need to implement all the functionality twice. Who is going to do that?
- the8472 4y agoEveryone who doesn't tightly control the systems they deploy to. io_uring is a new and developing interface so to support extant systems running libraries need to have fallback codepaths. Or more likely: they already have existing codepaths for the previous interfaces and add io_uring as a faster alternative.