3 ms·
If you need a searchable syscall table, then your kernel is a kitchen-sink dumping ground for code AND has a giant attack surface with unknown # of LCE 0d's. T
by 1letterunixname 4y ago
If you need a searchable syscall table, then your kernel is a kitchen-sink dumping ground for code AND has a giant attack surface with unknown # of LCE 0d's.
There needs to be improvements in eBPF-like DSL/VMs that run in isolated, in-kernel contexts to accomplish particular latency-sensitive and coordination tasks. These can potentially be JITed as well.
- Retr0id 4y ago> These can potentially be JITed as well. In-kernel JIT is a scary prospect. I'm sure it can be done securely (perhaps even provably so), but it's a whole can of security-flavoured worms in itself.
- LargoLasskhyfv 4y agohttps://man.netbsd.org/bpfjit.4 https://man.netbsd.org/bpfjit.4
- Retr0id 4y agoNot the same BPF JIT, but, https://www.cvedetails.com/cve/CVE-2021-29154/ https://www.cvedetails.com/cve/CVE-2021-29154/
- LargoLasskhyfv 4y agoI'm aware of that. But it's fun, the same way as Lua in the kernel. Which simplyfies picking parts out and moving them into https://en.wikipedia.org/wiki/Rump_kernel https://en.wikipedia.org/wiki/Rump_kernel , or FPGAs. I've been wary to use that on a system locked down with https://en.wikipedia.org/wiki/Veriexec https://en.wikipedia.org/wiki/Veriexec exposed to the net in the past, but not anymore. OTOH it's all moot, or are you using a browser with settings which BLOCK JS, WEB-RTC/GL/GPU and countless other stuff by default?