3 ms·
with linux 6.0, lsm got the ability to filter io_uring. deny all and carry on.
by nathants 4y ago
with linux 6.0, lsm got the ability to filter io_uring. deny all and carry on.
- insanitybit 4y agoCan you provide a source? Eager to read about how this is done.
- nathants 4y agohttps://github.com/torvalds/linux/blob/d47136c2801540e80f41ec7e063d8d592568ad76/include/linux/lsm_hooks.h#L1589 https://github.com/torvalds/linux/blob/d47136c2801540e80f41e...
- insanitybit 4y agoAre they just going to keep adding hooks to every new system call implemented for io_uring?
- nathants 4y agomy understanding is that this hook is the only one, but to properly secure io_uring one has to implement a check for every call here. or just disable it.