[lkml]   [2011]   [May]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
Messages in this thread
    SubjectRe: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering

    * Linus Torvalds <> wrote:

    > And per-system-call permissions are very dubious. What system calls
    > don't you want to succeed? That ioctl? You just made it impossible
    > to do a modern graphical application. Yet the kind of thing where
    > we would _want_ to help users is in making it easier to sandbox
    > something like the adobe flash player. But without accelerated
    > direct rendering, that's not going to fly, is it?

    I was under the impression that Will had a very specific application
    in mind which actually works today and uses the inferior version of

    Will, mind filling us in on that?

    I'd agree that adding any of this without a real serious app making
    real use of it would be pointless. I discussed this under the
    impression that the app existed :-)

    I also got the very distinct impression from the various iterations
    that a real usecase existed behind it - all the fixes and
    considerations looked very realistic, not designed up for security's

    > So I'm sorry for throwing cold water on you guys, but the whole
    > "let's come up with a new security gadget" thing just makes me go
    > "oh no, not again".

    Fair enough :-)



     \ /
      Last update: 2011-05-25 21:09    [W:0.030 / U:5.072 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site