cafkafk/lix
cafkafk/lix
1
0
Fork 0
Code Issues Pull requests 1 Projects Releases Packages Wiki Activity Actions
lix/doc/manual/rl-next/block-io-uring.md
Alois Wohlschlager e7188e211a
libstore/build: block io_uring 
Unfortunately, io_uring is totally opaque to seccomp, and while currently there
are no dangerous operations implemented, there is no guarantee that it remains
this way. This means that io_uring should be blocked entirely to ensure that
the sandbox is future-proof. This has not been observed to cause issues in
practice.

Change-Id: I45d3895f95abe1bc103a63969f444c334dbbf50d
2024-07-25 18:24:45 +02:00

620 B
Raw Blame History

synopsis cls credits category
Block io_uring in the Linux sandbox 1611 alois31 Breaking Changes

The io_uring API has the unfortunate property that it is not possible to selectively decide which operations should be allowed. This, together with the fact that new operations are routinely added, makes it a hazard to the proper function of the sandbox.

Therefore, any access to io_uring has been made unavailable inside the sandbox. As such, attempts to execute any system calls forming part of this API will fail with the error ENOSYS, as if io_uring support had not been configured into the kernel.