4 ms·
Both Docker and containerd have started to block io_uring in the default profile for about a year now due to too many security issues with it.
by cpuguy83 2y ago
Both Docker and containerd have started to block io_uring in the default profile for about a year now due to too many security issues with it.
- hinkley 2y agoHas anyone speculated yet about how much slower a secure io_uring has to be? Is it still a net win once you lock it down fully?
- JackSlateur 2y agoAs far as I know, io_uring is quite secure: a user cannot perform a syscall through it unless it has the privileges required to perform this syscall directly I would gladly get more details about the exact purpose of seccomp in a container environment. Reading a bit of internet, I find that docker "uses seccomp to block mount(2), which could be used to escape the container", which makes no sense to me because mount(2) requires CAP_SYS_ADMIN
- cpuguy83 2y agoio_uring cve's: https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=io_uring https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=io_uring seccomp is used for defense in depth. If someone managed to escalate privileges through some means the seccomp policy will still prevent them from doing nasty things or escalating further.
- poincaredisk 2y agoThat's not contradictory. Capabilities in docker are also limited, but both are used as a part of defense in depth.
- cpuguy83 2y agoThat would be impossible to know. The main thing with io_uring is it makes it so you don't need to context switch (ie make system calls) to perform a number of operations.
- bri3d 2y agoAnd Google, in ChromeOS, Android, and purportedly, Google production servers, for around a year and a half, as well. For this reason it's also disabled in several of the kernelCTF configurations and in the ones where it remains (GKE), it only pays out at half-rate in bug bounty.