Messages in this thread | | | From | Linus Torvalds <> | Date | Wed, 25 May 2011 13:01:39 -0700 | Subject | Re: [PATCH 3/5] v2 seccomp_filters: Enable ftrace-based system call filtering |
| |
On Wed, May 25, 2011 at 12:11 PM, Kees Cook <kees.cook@canonical.com> wrote: > > Uhm, what? Chrome would use it. And LXC would. Those were stated very > early on as projects extremely interested in syscall filtering.
.. and I seriously doubt it is workable.
Or at least it needs some actual working proof-of-concept thing. Exactly because of issues like direct rendering etc, that require some of the nastier system calls to work at all.
As to your example of apache modules - last I saw, most of those were written in high-level scripting languages that almost invariably end up using quite a bit of the system call interfaces. And more importantly, almost nobody does unportable code.
So hey, I'm willing to be convinced. But I'll need more than people _saying_ that they'd be interested. Because judging by past performance, nobody ever uses esoteric cool new features.
Linus
| |