linux-kernel - Re: [RFC PATCH seccomp 0/2] seccomp: Add bitmap cache of arg-independent filter results that allow syscalls

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <CAG48ez3+fAjOsktPFmatFPx9cVCvvguQQT5UYbBS6zRZ0RK9WQ@mail.gmail.com>
Date:   Mon, 21 Sep 2020 21:45:23 +0200
From:   Jann Horn <jannh@...gle.com>
To:     Hubertus Franke <frankeh@...ibm.com>
Cc:     Andrea Arcangeli <aarcange@...hat.com>, bpf <bpf@...r.kernel.org>,
        Linux Containers <containers@...ts.linux-foundation.org>,
        Aleksa Sarai <cyphar@...har.com>,
        Dimitrios Skarlatos <dskarlat@...cmu.edu>,
        Giuseppe Scrivano <gscrivan@...hat.com>,
        Jack Chen <jianyan2@...inois.edu>,
        Kees Cook <keescook@...omium.org>,
        kernel list <linux-kernel@...r.kernel.org>,
        Andy Lutomirski <luto@...capital.net>,
        Tobin Feldman-Fitzthum <tobin@....com>,
        Josep Torrellas <torrella@...inois.edu>,
        Tianyin Xu <tyxu@...inois.edu>,
        Valentin Rothberg <vrothber@...hat.com>,
        Will Drewry <wad@...omium.org>,
        YiFei Zhu <yifeifz2@...inois.edu>,
        YiFei Zhu <zhuyifei1999@...il.com>
Subject: Re: [RFC PATCH seccomp 0/2] seccomp: Add bitmap cache of
 arg-independent filter results that allow syscalls

On Mon, Sep 21, 2020 at 9:35 PM Hubertus Franke <frankeh@...ibm.com> wrote:
> I suggest we first bring it down to the minimal features we what and successively build the functions as these ideas evolve.
> We asked YiFei to prepare a minimal set that brings home the basic features. Might not be 100% optimal but having the hooks, the basic cache in place and getting a good benefit should be a good starting point
> to get this integrated into a linux kernel and then enable a larger experimentation.
> Does that make sense to approach it from that point ?

Sure. As I said, I don't think that the procfs part is a blocker - if
YiFei doesn't want to implement it now, I don't think it's necessary.
(But it would make it possible to write more precise tests.)

By the way: Please don't top-post on mailing lists - instead, quote
specific parts of a message and reply below those quotes. Also, don't
send HTML mail to kernel mailing lists, because they will reject it.