io_uring [LWN.net]

io_uring

Posted Jun 5, 2026 15:32 UTC (Fri) by bluca (subscriber, #118303)
In reply to: io_uring by josh
Parent article: Moving beyond fork() + exec()

One major difference is that there would be no seccomp support, which for something that allows spawning processes would be a pretty major shortcoming. I'm not up to date on the generic LSM story aside from that, but at some point it I think it basically boiled down to "block iouring" or "allow iouring" and that was it, maybe things have moved on that front though

to post comments

io_uring

Posted Jun 5, 2026 15:41 UTC (Fri) by krisman (subscriber, #102057) [Link] (5 responses)

Not true anymore. We now have per-operation bpf-based filtering in io_uring.

io_uring

Posted Jun 5, 2026 15:55 UTC (Fri) by bluca (subscriber, #118303) [Link] (2 responses)

So still no seccomp, and requires its own bespoke filtering? As a userspace developer making heavy use of pidfd_spawn I'd much rather have a normal syscall based approach, like fsconfig(). Much nicer, and integrates much better with the existing sandboxing ecosystem. fsconfig/opentree/movemount/etc are a really nice family of APIs, well designed and pleasant to use.

io_uring

Posted Jun 5, 2026 16:09 UTC (Fri) by josh (subscriber, #17465) [Link] (1 responses)

No matter what filtering mechanism you use, operations in io_uring do not map 1:1 to syscalls. I think the BPF-based filtering in io_uring is a reasonable mapping of filtering to the concepts of io_uring. Using seccomp would still require substantially adapting seccomp; existing filters would not Just Work.

io_uring

Posted Jun 7, 2026 7:13 UTC (Sun) by daandemeyer (subscriber, #163201) [Link]

Uring has its own filtering mechanism these days. Not quite seccomp but close. But I doubt any userspace has plumbed it through already. Will take years likely before uring is removed from existing seccomp profiles.

io_uring

Posted Jun 7, 2026 3:30 UTC (Sun) by DemiMarie (subscriber, #164188) [Link]

Can that be enforced by a sandboxing tool and automatically applied to all rings created by a child process?

Until Google enables io_uring for third-party apps on Android I will stay skeptical.

io_uring filtering

Posted Jun 7, 2026 3:30 UTC (Sun) by DemiMarie (subscriber, #164188) [Link]

Can the filtering be enforced by a sandboxing tool and automatically applied to all rings created by a child process? Does it require eBPF or only cBPF?

Until Google enables io_uring for third-party apps on Android I will stay skeptical