lkml.org 
[lkml]   [2009]   [Jan]   [12]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: RFC: Network privilege separation.
    On Mon, Jan 12, 2009 at 10:47:21PM +0200, Rémi Denis-Courmont wrote:
    > Le lundi 12 janvier 2009 22:55:47 Andi Kleen, vous avez écrit :
    > > Fair point, although I'm afraid you didn't do a very good
    > > job explaining your reasons, so it sounds like a
    > > quite arbitary decision.
    >
    > Fair enough. It's just way too much interface/adaptation work compared to the
    > benefit. Especially considering that it would be much easier, and almost as
    > secure, with a "relaxed" SECCOMP.

    What system calls would you want in a relaxed SECCOMP?

    > And on top of that, it's causing
    > unnecessary overhead (we're also interested in those small Linux-based

    Would be interesting to try that out -- just adding two memcpyies to
    the existing code and see how much slower it gets. My guess
    would be not very, even e.g. on a Atom system (which are really
    not all that slow).

    Presumably you could always #ifdef it if it's really a problem
    on some specific system. That would be needed anyways for
    non linux systems.

    -And

    --
    ak@linux.intel.com -- Speaking for myself only.
    --
    To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
    the body of a message to majordomo@vger.kernel.org
    More majordomo info at http://vger.kernel.org/majordomo-info.html
    Please read the FAQ at http://www.tux.org/lkml/

    \
     
     \ /
      Last update: 2009-01-12 22:39    [W:0.024 / U:62.800 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site