Why can't seccomp() check io_uring-generated syscalls?
Why can't seccomp() check io_uring-generated syscalls?
Posted Feb 8, 2026 0:23 UTC (Sun) by corbet (editor, #1)In reply to: Why can't seccomp() check io_uring-generated syscalls? by reillyeon
Parent article: Task-level io_uring restrictions
Io_uring really is an entirely separate interface to kernel-provided functionality. It has things like descriptorless files, for example. Many io_uring operations mirror normal system calls, but others do not.
One could probably find a way to extend seccomp() to handle it, but it would probably not be a smaller project than what is being proposed here.