Hacker News Reader

It's still seccomp'd off in most environments because io-uring is still a seccomp bypass that doesn't play well with kernel security systems (audit subsystem), even if it weren't also like the #1 or #2 exploit vector for privesc.

View on HN

That’s solved as of last week, you can use cBPF now to disable functionality.

How solved? AFAIK it's not meaningfully shipped but happy to hear otherwise.

you can now disable opertions with cBPF, like you would be able to with seccomp for normal syscalls.

Their point is that that functionality is not available on older kernels (such as those in RHEL 9 and 10) and so most sandboxes will continue to block it outright for a while, though eventually one would expect Red Hat to backport it.

(We haven't even added support for the new cBPF io_uring stuff to low-level container runtimes like runc yet, though I did review the patchset on LKML earlier this year and planned to get working on it when I have time. But as it requires spec changes, expect it to take 6-12 months at best...)

Thanks for that! Hope 2027 will then be the year we get the speed back all those spectre etc mitgitations ate for those syscalls io_uring can replace.

Reply on news.ycombinator.com