Re: [gentoo-dev] [rfc] enable USE=seccomp in default/linux/ profiles

2015-02-19 Thread Markos Chandras
-BEGIN PGP SIGNED MESSAGE- Hash: SHA512 On 02/19/15 21:14, Mike Frysinger wrote: > pro: improved security in daemons (often network) con: some > packages might pull in libseccomp (~250KB) > > there shouldn't be measurable runtime overhead here as the > filtering is done by a JIT in the ke

Re: [gentoo-dev] [rfc] enable USE=seccomp in default/linux/ profiles

2015-02-19 Thread Patrick McLean
On Thu, 19 Feb 2015 14:14:37 -0500 Mike Frysinger wrote: > pro: improved security in daemons (often network) > con: some packages might pull in libseccomp (~250KB) > > there shouldn't be measurable runtime overhead here as the filtering > is done by a JIT in the kernel itself. if the kernel lac

[gentoo-dev] [rfc] enable USE=seccomp in default/linux/ profiles

2015-02-19 Thread Mike Frysinger
pro: improved security in daemons (often network) con: some packages might pull in libseccomp (~250KB) there shouldn't be measurable runtime overhead here as the filtering is done by a JIT in the kernel itself. if the kernel lacks support for seccomp, daemons generally should fallback at runtim