Lord of the Io_uring (2020)

44•ibobev•5mo ago

Comments

p_ing•5mo ago

From 5 years ago - https://news.ycombinator.com/item?id=23132549

8 Months - https://news.ycombinator.com/item?id=42608436

jeffbee•5mo ago

No io_uring explainer is complete without a comprehensive running list of all the vulnerabilities discovered (so far) and the consequent API and behavior changes. This one, unfortunately, has been static since 2020, which means it comes from the time when io_uring seemed like it might be a fairly OK idea, instead of the toxic waste spill it turned out to be.

coppsilgold•5mo ago

While the situation has improved, if your threat model is such you can block io_uring during boot or in containers with a seccomp policy:

    DENY_RULE (io_uring_enter, EPERM);
    DENY_RULE (io_uring_register, EPERM);
    DENY_RULE (io_uring_setup, EPERM);

LtWorf•5mo ago

Also user namespaces have had a long list of vulnerabilities, but that's still better than running docker as root directly.

jeffbee•5mo ago

Hrmm. "Take over the entire machine" type vulnerabilities, or "these namespaces weren't quite as isolated as we thought" vulnerabilities?

LtWorf•5mo ago

CVEs are publicly available

chupasaurus•5mo ago

The latter can easily propagate to the former if seccomp/AppArmor/MAC isn't set properly.

cpuguy83•5mo ago

Escalating from an unprivileged user to root by creating userns and exploiting various things in the kernel along the way.

cpuguy83•5mo ago

That is a ridiculous statement. In the case of userns exploits there have been many and it means that every unprivileged user can obtain root on the machine.

Whereas rootful docker is a well known thing, run on millions of machines, and none of the vulnerabilities discovered in its entire existence is as bad as any single priv escalation issue caused by allowing unprivileged users to create a user namespace.

LtWorf•5mo ago

Lol that's just like saying having no door is better because some people can pick locks and occasionally open doors.

cpuguy83•5mo ago

No, it's saying the door is a lie. At least within the context of your statement about vulnerabilities.

epolanski•5mo ago

All critical flaws seen so far have seen patches and fixes.

Analemma_•5mo ago

What is it with io_uring and btrfs in particular that gives people a compulsive urge to bring up bugs from years ago as proof that they should never be used. Yeah, huge complicated new subsystems land with bugs, and then they gradually get fixed. I’m sorry we can’t all ship perfect bug-free software on the first release, please be kind to us mere mortals.

jeffbee•5mo ago

io_uring is fundamentally under-designed and will never work correctly. It cannot be incrementally reformed.

lantastic•5mo ago

Care to elaborate?

yencabulator•5mo ago

You'll need to say a little more than that to be taken seriously. Are you just against all things new, or is there something in the core API that is a bad idea? Surely you're not against the idea of ringbuffers in general, or saying "new thing bad, grug like old thing"?

Pretty much everything high performance is ringbuffers these days, e.g. NVMe. What makes io_uring the one thing that cannot be done?

zygentoma•5mo ago

The legends on the graphs are so small, that I can't read them on my smartphone ... and of course the Website does not allow me to zoom in >_>

pritambaral•5mo ago

Firefox on Android has a setting to force enable zoom on all websites, even those that disable it.

P2P crypto exchange development company

Vocal Guide – belt sing without killing yourself

Write for Your Readers Even If They Are Agents

Knowledge-Creating LLMs

Maple Mono: Smooth your coding flow

Sid Meier's System for Real-Time Music Composition and Synthesis

Show HN: Slop News – HN front page now, but it's all slop

Show HN: Empusa – Visual debugger to catch and resume AI agent retry loops

Show HN: Bitcoin wallet on NXP SE050 secure element, Tor-only open source

White House Explores Opening Antitrust Probe on Homebuilders

Show HN: MindDraft – AI task app with smart actions and auto expense tracking

How do you estimate AI app development costs accurately?

Going Through Snowden Documents, Part 5

Show HN: MCP Server for TradeStation

Canada unveils auto industry plan in latest pivot away from US

The essential Reinhold Niebuhr: selected essays and addresses

Rentahuman.ai Turns Humans into On-Demand Labor for AI Agents

StovexGlobal – Compliance Gaps to Note

Show HN: Afelyon – Turns Jira tickets into production-ready PRs (multi-repo)

Trump says America should move on from Epstein – it may not be that easy

Tiny Clippy – A native Office Assistant built in Rust and egui

LegalArgumentException: From Courtrooms to Clojure – Sen [video]

US moves to deport 5-year-old detained in Minnesota

If you lose your passport in Austria, head for McDonald's Golden Arches

Show HN: Mermaid Formatter – CLI and library to auto-format Mermaid diagrams

RFCs vs. READMEs: The Evolution of Protocols

Kanchipuram Saris and Thinking Machines

Chinese chemical supplier causes global baby formula recall

I've used AI to write 100% of my code for a year as an engineer

Looking for 4 Autistic Co-Founders for AI Startup (Equity-Based)

P2P crypto exchange development company

Vocal Guide – belt sing without killing yourself

Write for Your Readers Even If They Are Agents

Knowledge-Creating LLMs

Maple Mono: Smooth your coding flow

Sid Meier's System for Real-Time Music Composition and Synthesis

Show HN: Slop News – HN front page now, but it's all slop

Show HN: Empusa – Visual debugger to catch and resume AI agent retry loops

Show HN: Bitcoin wallet on NXP SE050 secure element, Tor-only open source

White House Explores Opening Antitrust Probe on Homebuilders

Show HN: MindDraft – AI task app with smart actions and auto expense tracking

How do you estimate AI app development costs accurately?

Going Through Snowden Documents, Part 5

Show HN: MCP Server for TradeStation

Canada unveils auto industry plan in latest pivot away from US

The essential Reinhold Niebuhr: selected essays and addresses

Rentahuman.ai Turns Humans into On-Demand Labor for AI Agents

StovexGlobal – Compliance Gaps to Note

Show HN: Afelyon – Turns Jira tickets into production-ready PRs (multi-repo)

Trump says America should move on from Epstein – it may not be that easy

Tiny Clippy – A native Office Assistant built in Rust and egui

LegalArgumentException: From Courtrooms to Clojure – Sen [video]

US moves to deport 5-year-old detained in Minnesota

If you lose your passport in Austria, head for McDonald's Golden Arches

Show HN: Mermaid Formatter – CLI and library to auto-format Mermaid diagrams

RFCs vs. READMEs: The Evolution of Protocols

Kanchipuram Saris and Thinking Machines

Chinese chemical supplier causes global baby formula recall

I've used AI to write 100% of my code for a year as an engineer

Looking for 4 Autistic Co-Founders for AI Startup (Equity-Based)

Lord of the Io_uring (2020)

Comments