3 ms·

How solved? AFAIK it's not meaningfully shipped but happy to hear otherwise.

• Asmod4n 4mo ago
  you can now disable opertions with cBPF, like you would be able to with seccomp for normal syscalls.
  • cyphar 4mo ago
    Their point is that that functionality is not available on older kernels (such as those in RHEL 9 and 10) and so most sandboxes will continue to block it outright for a while, though eventually one would expect Red Hat to backport it. (We haven't even added support for the new cBPF io_uring stuff to low-level container runtimes like runc yet, though I did review the patchset on LKML earlier this year and planned to get working on it when I have time. But as it requires spec changes, expect it to take 6-12 months at best...)
    • Asmod4n 4mo ago
      Thanks for that! Hope 2027 will then be the year we get the speed back all those spectre etc mitgitations ate for those syscalls io_uring can replace.