lkml.org 
[lkml]   [2022]   [Dec]   [2]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] error-injection: Add prompt for function error injection
    On Thu, Dec 01, 2022 at 05:41:29PM -0800, Alexei Starovoitov wrote:
    >
    > The fault injection framework disables individual syscall with zero performance
    > overhead comparing to LSM and seccomp mechanisms.
    > BPF is not involved here. It's a kprobe in one spot.
    > All other syscalls don't notice it.
    > It's an attractive way to improve security.
    >
    > A BPF prog over syscall can filter by user, cgroup, task and give fine grain
    > control over security surface.
    > tbh I'm not aware of folks doing "syscall disabling" through command line like
    > above (I've only seen it through bpf), but it doesn't mean that somebody will
    > not start complaining that their script broke, because distro disabled fault
    > injection.
    >
    > So should we split FUNCTION_ERROR_INJECTION kconfig into two ?
    > And do default N for things like should_failslab() and
    > default Y for syscalls?

    How about calling the latter something like bpf syscall hooks, and not
    using the terminology "error injection" in relation to system calls?
    I think that might be less confusing.

    - Ted

    \
     
     \ /
      Last update: 2022-12-02 16:58    [W:2.383 / U:0.260 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site