On: Epoll vs. io_uring in Linux

[Asmod4n]

That’s solved as of last week, you can use cBPF now to disable functionality.

[insanitybit → Asmod4n]

How solved? AFAIK it's not meaningfully shipped but happy to hear otherwise.

[Asmod4n → insanitybit]

you can now disable opertions with cBPF, like you would be able to with seccomp for normal syscalls.

[cyphar → Asmod4n]

Their point is that that functionality is not available on older kernels (such as those in RHEL 9 and 10) and so most sandboxes will continue to block it outright for a while, though eventually one would expect Red Hat to backport it.

(We haven't even added support for the new cBPF io_uring stuff to low-level container runtimes like runc yet, though I did review the patchset on LKML earlier this year and planned to get working on it when I have time. But as it requires spec changes, expect it to take 6-12 months at best...)

[Asmod4n → cyphar]

Thanks for that! Hope 2027 will then be the year we get the speed back all those spectre etc mitgitations ate for those syscalls io_uring can replace.