3 ms·
It's still seccomp'd off in most environments because io-uring is still a seccomp bypass that doesn't play well with kernel security systems (audit subsystem),
by insanitybit 4mo ago
It's still seccomp'd off in most environments because io-uring is still a seccomp bypass that doesn't play well with kernel security systems (audit subsystem), even if it weren't also like the #1 or #2 exploit vector for privesc.
- Asmod4n 4mo agoThat’s solved as of last week, you can use cBPF now to disable functionality.
- insanitybit 4mo agoHow solved? AFAIK it's not meaningfully shipped but happy to hear otherwise.
- Asmod4n 4mo agoyou can now disable opertions with cBPF, like you would be able to with seccomp for normal syscalls.
- cyphar 4mo agoTheir point is that that functionality is not available on older kernels (such as those in RHEL 9 and 10) and so most sandboxes will continue to block it outright for a while, though eventually one would expect Red Hat to backport it. (We haven't even added support for the new cBPF io_uring stuff to low-level container runtimes like runc yet, though I did review the patchset on LKML earlier this year and planned to get working on it when I have time. But as it requires spec changes, expect it to take 6-12 months at best...)
- Asmod4n 4mo agoThanks for that! Hope 2027 will then be the year we get the speed back all those spectre etc mitgitations ate for those syscalls io_uring can replace.