seccomp changes are already in the kernel. syscalls are different from normal function calls in that they cause interrupt that is trapped by kernel to handle switch from userspace to kernelspace. emulating it in userspace would mean modifying executable code so that interrupt is not taken and that would trip some integrity checks. so it is less desirable than having the (already existing) support in-kernel.
See description of this patch from 2020: https://lore.kernel.org/lkml/[email protected]/T/
Performance is also important factor.
Performance is also important factor.
With all due respect, the title of the video is “Efficent syscall emulation on Linux”
Performance is also important factor.
With all due respect, the title of the video is “Efficent syscall emulation on Linux”
"fast" or "efficient" are not absolute values, they are always in comparison to something.
Either way, looks like kernel has merged this (in 6.4 I think): https://www.kernel.org/doc/html/latest/admin-guide/syscall-user-dispatch.html
Nothing extracted yet.
Feature Request
I confirm:
contain this feature already.
Description
I think it would be useful to use syscall emulation to try and support kernel level anticheats in Linux there’s already work being done by collabora but I’m not sure if it’s ready yet
https://youtube.com/watch?v=B35XhcmBDDI
Justification [optional]
There is a syscall emulation patch in wine staging but it’s not merged yet and I haven’t tested if it works
Risks [optional]
References [optional]