| Date | Mon, 30 Dec 2019 11:30:19 -0800 | From | Kees Cook <> | Subject | Re: [PATCH bpf-next v1 00/13] MAC and Audit policy using eBPF (KRSI) |
| |
On Fri, Dec 20, 2019 at 11:46:47PM +0100, Mickaël Salaün wrote: > I'm working on a version of Landlock without eBPF, but still with the > initial sought properties: safe unprivileged composability, modularity, and > dynamic update. I'll send this version soon. > > I hope that the work and experience from Landlock to bring eBPF to LSM will > continue to be used through KRSI. Landlock will now focus on the > unprivileged sandboxing part, without eBPF. Stay tuned!
Will it end up looking at all like pledge? I'm still struggling to come up with a sensible pledge-like design on top of seccomp, especially given the need to have it very closely tied to the running libc...
-- Kees Cook
|