Re: RFC: Network privilege separation.

[Andi Kleen <andi@firstfloor.org>]

On Mon, Jan 12, 2009 at 10:47:21PM +0200, Rémi Denis-Courmont wrote:
> Le lundi 12 janvier 2009 22:55:47 Andi Kleen, vous avez écrit :
> > Fair point, although I'm afraid you didn't do a very good
> > job explaining your reasons, so it sounds like a
> > quite arbitary decision.
> 
> Fair enough. It's just way too much interface/adaptation work compared to the 
> benefit. Especially considering that it would be much easier, and almost as 
> secure, with a "relaxed" SECCOMP. 

What system calls would you want in a relaxed SECCOMP?

> And on top of that, it's causing 
> unnecessary overhead (we're also interested in those small Linux-based 

Would be interesting to try that out -- just adding two memcpyies to 
the existing code and see how much slower it gets. My guess
would be not very, even e.g. on a Atom system (which are really
not all that slow).

Presumably you could always #ifdef it if it's really a problem
on some specific system. That would be needed anyways for 
non linux systems.

-And

-- 
ak@linux.intel.com -- Speaking for myself only.