Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

What would you want to do with seccomp-bpf that can't be expressed with BPF? Or did I misunderstand the comment?

You want to allow or deny calls based on syscall args, which seems to fit the BPF model. Perhaps string matching is where it breaks down, since syscall args have strings and network packets don't? I suppose a stripped down regex like Lua's might be useful for matching arguments that are file system paths, and that is firmly outside BPF as far as I understand.

I would guess that they wanted to reuse a VM already in the kernel, and that had a fast JIT implementation, but I'm just speculating.



The BPF VM is suitable for system call arguments, but probably not optimal for performance.

The pcap compiler is not particularly well-suited for system call arguments.

The real reason to use the BPF VM, as opposed to any other VM or decision tree, is the pcap compiler, which doesn't buy much for system calls.


Well, I think it makes sense given the history. When seccomp-bpf and the other stuff was introduced, there was already a BPF VM in the kernel designed to efficiently run untrusted code (although seccomp-bpf can't use the JIT today); adding another VM is a maintainability and security hazard, and simplicity is good for security, so why not adapt it?

And now that it exists, it makes sense to evolve the bpf design to be more efficient but keep the result backwards compatible and unified between subsystems.


There was the DIF vm from dtrace too already, it would have been a better fit but that's difficult regarding linux.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: