Re: PROBLEM: SECCOMP documentation outdated in some arch/*/Kconfig

[Andrea Arcangeli <andrea@cpushare.com>]

On Tue, Jan 22, 2008 at 04:21:56PM -0800, Randy Dunlap wrote:
> On Tue, 22 Jan 2008 15:41:58 +0100 Helmut Grohne wrote:
> 
> > Hi,
> > 
> > I didn't find out whom to report this bug to and thus report to
> > linux-kernel@vger.kernel.org as described in
> > http://kernel.org/pub/linux/docs/lkml/reporting-bugs.html.
> 
> Andrea cc-ed.
> 
> Helmut, would you care to make a patch that you think should be
> applied to the current kernel source tree?

I'd like to point out CPUShare will soon become an encrypted p2p
virtual ethernet (with mac->internet:port mapping managed by the
server and routed through the buyer node if behind nat) of KVM
machines (using -net tap,fd) so anything will run unmodified
(including non-linux guest) and it can be trivally bridged to extend
the local ethernet. This was forced because despite enormous buyer
(and obviously seller) interest, very few of the buyers are capable of
writing .c and .py software to make the required modifications to
their apps to run on CPUShare (the JtR patch for seccomp was <500lines
but it's still a way too high barrier, especially during this startup
phase). After the switch to KVM, the only requirement to buy CPU power
on CPUShare is to be able to create a livecd, something more people
should be capable of doing.

Given not everyone was happy with seccomp, this would be a good time
to speak again against it, as I wouldn't be objecting its removal (not
from a CPUShare POV at least). I'd personally like seccomp to stay and
to update the Kconfig because I think it can be useful still and it's
the most secure model.