lkml.org 
[lkml]   [2009]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    From
    SubjectRe: RFC: Network privilege separation.
    Date
    Le lundi 12 janvier 2009 22:14:35 Andi Kleen, vous avez écrit :
    > > Expanding the heap,
    >
    > That's a problem agreed Ok you can just always use very
    > bss arrays sized for the worst case.
    >
    > > Getting timestamps.
    >
    > At least on 64bit that's done in ring 3 only with a vsyscall.
    >
    > > Waiting on futexes,
    > > catching signals, polling file descriptors. Seeking, doing vectorized
    > > I/O. Cloning.
    >
    > That all can be done by the frontend reading/feeding
    > data into the pipe. But it shouldn't directly access the user data
    > to be immune against attacks.

    What's the point of writing a parser (that could also have bugs) when the
    kernel can do it? One could argue that shared futexes could be dangerous, but
    not the rest?

    > > Codecs don't like to read/write raw video through a pipe...
    >
    > I don't think that's given. It would need some restructuring,
    > but I think the end result would be likely worth it.

    A normal DVD would be over 30 megabytes per seconds once decoded, just for the
    video. And remember vmsplice() is not allowed by SECCOMP. Media players have
    assembly-coded memory copy optimizations (like the kernel) for some reason.

    --
    Rémi Denis-Courmont
    http://www.remlab.net/
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2009-01-12 21:19    [W:0.040 / U:30.024 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site