Re: [PATCH 2/2] x86-64: seccomp: fix 32/64 syscall hole

On Wed, 2009-05-06 at 15:21 -0700, Markus Gutschke (顧孟勤) wrote:

On Wed, May 6, 2009 at 15:13, Ingo Molnar [off-list ref] wrote:

quoted

doing a (per arch) bitmap of harmless syscalls and replacing the
mode1_syscalls[] check with that in kernel/seccomp.c would be a
pretty reasonable extension. (.config controllable perhaps, for
old-style-seccomp)

It would probably be faster than the current loop over
mode1_syscalls[] as well.

This would be a great option to improve performance of our sandbox. I
can detect the availability of the new kernel API dynamically, and
then not intercept the bulk of the system calls. This would allow the
sandbox to work both with existing and with newer kernels.

We'll post a kernel patch for discussion in the next few days,

I suspect the correct thing to do would be to leave seccomp mode 1 alone
and introduce a mode 2 with a less restricted set of system calls -- the
interface was designed to be extended in this way, after all.

-- 
Nicholas Miell [off-list ref]