Messages in this thread | | | Date | Mon, 12 Jan 2009 22:50:01 +0100 | From | Andi Kleen <> | Subject | Re: RFC: Network privilege separation. |
| |
On Mon, Jan 12, 2009 at 10:47:21PM +0200, Rémi Denis-Courmont wrote: > Le lundi 12 janvier 2009 22:55:47 Andi Kleen, vous avez écrit : > > Fair point, although I'm afraid you didn't do a very good > > job explaining your reasons, so it sounds like a > > quite arbitary decision. > > Fair enough. It's just way too much interface/adaptation work compared to the > benefit. Especially considering that it would be much easier, and almost as > secure, with a "relaxed" SECCOMP.
What system calls would you want in a relaxed SECCOMP?
> And on top of that, it's causing > unnecessary overhead (we're also interested in those small Linux-based
Would be interesting to try that out -- just adding two memcpyies to the existing code and see how much slower it gets. My guess would be not very, even e.g. on a Atom system (which are really not all that slow).
Presumably you could always #ifdef it if it's really a problem on some specific system. That would be needed anyways for non linux systems.
-And
-- ak@linux.intel.com -- Speaking for myself only. -- To unsubscribe from this list: send the line "unsubscribe linux-kernel" in the body of a message to majordomo@vger.kernel.org More majordomo info at http://vger.kernel.org/majordomo-info.html Please read the FAQ at http://www.tux.org/lkml/
| |