3 ms·
Rephrasing the sentiments of the article: • io_uring is quite new, and currently still having some severe security problems. • Most kernel security bugs, they
by chrismorgan 3y ago
Rephrasing the sentiments of the article:
• io_uring is quite new, and currently still having some severe security problems.
• Most kernel security bugs, they can mitigate effectively. But their mitigations aren’t fully effective on io_uring.
• Therefore, until the security problems die down or until they can effectively mitigate io_uring security bugs, they’re disabling it, because the security concerns outweigh the performance advantages.
- johncolanduoni 3y ago> • Most kernel security bugs, they can sandbox effectively. But their sandboxing isn’t fully effective on io_uring. This is definitely not true in general for their platform: I don’t believe they do any shared-kernel sandboxing of untrusted code at this point and their primary sandbox gVisor (used for stuff like App Engine, Cloud Functions, and Cloud Run) just doesn’t simulate io_uring at all.
- chrismorgan 3y ago“Sandboxing” was the wrong word to use; I was referring to what they call “mitigations”. Following through a few links, you can end up at https://github.com/thejh/linux/blob/slub-virtual/MITIGATION_README https://github.com/thejh/linux/blob/slub-virtual/MITIGATION_... which describes what it all actually is. I was figuring that sandboxing was probably close enough as a description, and maybe more easily understood, but that wasn’t wise. I’ve changed it to use their wording.