io_uring [LWN.net]

io_uring

Posted Jun 5, 2026 15:55 UTC (Fri) by bluca (subscriber, #118303)
In reply to: io_uring by krisman
Parent article: Moving beyond fork() + exec()

So still no seccomp, and requires its own bespoke filtering? As a userspace developer making heavy use of pidfd_spawn I'd much rather have a normal syscall based approach, like fsconfig(). Much nicer, and integrates much better with the existing sandboxing ecosystem. fsconfig/opentree/movemount/etc are a really nice family of APIs, well designed and pleasant to use.

to post comments

io_uring

Posted Jun 5, 2026 16:09 UTC (Fri) by josh (subscriber, #17465) [Link] (1 responses)

No matter what filtering mechanism you use, operations in io_uring do not map 1:1 to syscalls. I think the BPF-based filtering in io_uring is a reasonable mapping of filtering to the concepts of io_uring. Using seccomp would still require substantially adapting seccomp; existing filters would not Just Work.

io_uring

Posted Jun 7, 2026 7:13 UTC (Sun) by daandemeyer (subscriber, #163201) [Link]

Uring has its own filtering mechanism these days. Not quite seccomp but close. But I doubt any userspace has plumbed it through already. Will take years likely before uring is removed from existing seccomp profiles.