3 ms·
These security tools need to block any system call they don't recognize (fail closed). Obviously this breaks some apps but the alternative is huge security hole
by wmf 2y ago
These security tools need to block any system call they don't recognize (fail closed). Obviously this breaks some apps but the alternative is huge security holes.
- hellow0rld123 2y agoMaybe not blocking, but the problem is that they rely on system calls for visability for system events and that's the problem because we have mechanisms like io_uring which can allow attackers to so certain actions without making any system calls.
- wmf 2y agoio_uring is a system call. Security tools could analyze it but they don't because they haven't been updated.