| |||||||||||||
Cook: seccomp filter now in UbuntuCook: seccomp filter now in UbuntuPosted Mar 26, 2012 20:12 UTC (Mon) by Cyberax (✭ supporter ✭, #52523)In reply to: Cook: seccomp filter now in Ubuntu by slashdot Parent article: Cook: seccomp filter now in Ubuntu
BPF is a VERY simple language, it translates naturally to machine code. BPF JIT doesn't need to keep state, complex data structures and so on.
And BPF programs _by_ _design_ can not be used to attack the kernel. Simply because they don't allow arbitrary expressions, only a safe verifiable subset.
(Log in to post comments)
|
|||||||||||||