Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753376Ab1EYUCg (ORCPT ); Wed, 25 May 2011 16:02:36 -0400 Received: from smtp1.linux-foundation.org ([140.211.169.13]:44279 "EHLO smtp1.linux-foundation.org" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753042Ab1EYUCf (ORCPT ); Wed, 25 May 2011 16:02:35 -0400 MIME-Version: 1.0 In-Reply-To: <20110525191152.GC19633@outflux.net> References: <1305807728.11267.25.camel@gandalf.stny.rr.com> <1306254027.18455.47.camel@twins> <20110524195435.GC27634@elte.hu> <20110525150153.GE29179@elte.hu> <20110525180100.GY19633@outflux.net> <20110525191152.GC19633@outflux.net> From: Linus Torvalds Date: Wed, 25 May 2011 13:01:39 -0700 Message-ID: Subject: Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering To: Kees Cook Cc: Thomas Gleixner , Ingo Molnar , Peter Zijlstra , Will Drewry , Steven Rostedt , linux-kernel@vger.kernel.org Content-Type: text/plain; charset=ISO-8859-1 Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org Content-Length: 1156 Lines: 26 On Wed, May 25, 2011 at 12:11 PM, Kees Cook wrote: > > Uhm, what? Chrome would use it. And LXC would. Those were stated very > early on as projects extremely interested in syscall filtering. .. and I seriously doubt it is workable. Or at least it needs some actual working proof-of-concept thing. Exactly because of issues like direct rendering etc, that require some of the nastier system calls to work at all. As to your example of apache modules - last I saw, most of those were written in high-level scripting languages that almost invariably end up using quite a bit of the system call interfaces. And more importantly, almost nobody does unportable code. So hey, I'm willing to be convinced. But I'll need more than people _saying_ that they'd be interested. Because judging by past performance, nobody ever uses esoteric cool new features. Linus -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/