On Wed, 2024-02-14 at 19:32 +0100, Petr Tesařík wrote: > > What use case needs to have the sandbox both protected from the > > kernel > > (trusted operations) and non-privileged (the kernel protected from > > it > > via CPL3)? It seems like opposite things. > > I think I have mentioned one: parsing keys for the trusted keyring. > The > parser is complex enough to be potentially buggy, but the security > folks have already dismissed the idea to run it as a user mode > helper. Ah, I didn't realize the kernel needed to be protected from the key parsing part because you called it out as a trusted operation. So on the protect-the-kernel-side it's similar to the microkernel security reasoning. Did I get the other part wrong - that you want to protect the sandbox from the rest of kernel as well?
