2 ms·
Yes, this is a thing. But the key difference there is... that's being done ... in user space. We live in a world where just last week Google turned off io_urin
by cmrdporcupine 3y ago
Yes, this is a thing. But the key difference there is... that's being done ... in user space.
We live in a world where just last week Google turned off io_uring access on a pile of machines, and that's only "executing" restricted sets of operations. Executable code in kernel = big giant target painted on back.
- archi42 3y agoAh, yes, that's an excellent point. Because someone else talked about 5% performance I looked at it with my performance hat on, not the security hat. OTOH we have BPFilter with its VM.