7 ms·
RHEL 9 and 10 now fully support io_uring by default. It is very recent, but this covers a lot of corporate Linux installs. Gemini 'said' Ubuntu and SuSE support
by csdreamer7 3mo ago
RHEL 9 and 10 now fully support io_uring by default. It is very recent, but this covers a lot of corporate Linux installs. Gemini 'said' Ubuntu and SuSE support it as well, but did not provide any links to prove it.
https://access.redhat.com/solutions/4723221 https://access.redhat.com/solutions/4723221
Go should reconsider support. They should have a 'go' at it.
- insanitybit 3mo agoIt's still seccomp'd off in most environments because io-uring is still a seccomp bypass that doesn't play well with kernel security systems (audit subsystem), even if it weren't also like the #1 or #2 exploit vector for privesc.
- Asmod4n 3mo agoThat’s solved as of last week, you can use cBPF now to disable functionality.
- insanitybit 3mo agoHow solved? AFAIK it's not meaningfully shipped but happy to hear otherwise.
- Asmod4n 3mo agoyou can now disable opertions with cBPF, like you would be able to with seccomp for normal syscalls.
- cyphar 3mo agoTheir point is that that functionality is not available on older kernels (such as those in RHEL 9 and 10) and so most sandboxes will continue to block it outright for a while, though eventually one would expect Red Hat to backport it. (We haven't even added support for the new cBPF io_uring stuff to low-level container runtimes like runc yet, though I did review the patchset on LKML earlier this year and planned to get working on it when I have time. But as it requires spec changes, expect it to take 6-12 months at best...)
- Asmod4n 3mo agoThanks for that! Hope 2027 will then be the year we get the speed back all those spectre etc mitgitations ate for those syscalls io_uring can replace.