Messages in this thread | | | Date | Mon, 21 Sep 2020 10:39:16 -0600 | From | Tycho Andersen <> | Subject | Re: [RFC PATCH seccomp 0/2] seccomp: Add bitmap cache of arg-independent filter results that allow syscalls |
| |
On Mon, Sep 21, 2020 at 10:27:56AM -0500, YiFei Zhu wrote: > On Mon, Sep 21, 2020 at 8:51 AM Tycho Andersen <tycho@tycho.pizza> wrote: > > One problem with a kernel config setting is that it's for all tasks. > > While docker and systemd may make decsisions based on syscall number, > > other applications may have more nuanced filters, and this cache would > > yield incorrect results. > > > > You could work around this by making this a filter flag instead; > > filter authors would generally know whether their filter results can > > be cached and probably be motivated to opt in if their users are > > complaining about slow syscall execution. > > > > Tycho > > Yielding incorrect results should not be possible. The purpose of the > "emulator" (for the lack of a better term) is to determine whether the > filter reads any syscall arguments. A read from a syscall argument > must go through the BPF_LD | BPF_ABS instruction, where the 32 bit > multiuse field "k" is an offset to struct seccomp_data.
I see, I missed this somehow. So is there a reason to hide this behind a config option? Isn't it just always better?
Tycho
| |