By: Gian-Carlo Pascutto (gcp.delete@this.sjeng.org), March 16, 2021 12:40 pm
Room: Moderated Discussions
anon2 (anon.delete@this.anon.com) on March 15, 2021 8:00 pm wrote:
> uses a very different architecture that does not farm out
> all requests via IPC to a broker service, but instead does the majority of the filtering inline via kernel
> facilities (namespaces, eBPF). I'll give you three guesses as to which model has better performance.
There's some misunderstanding here. On Linux desktop, Chrome does its API filtering via BPF (in seccomp) and Namespaces, with a fallback (via a setuid wrapper!) if those are not available.
But you need IPC if you need to get the remote party do something on your behalf outside of what the sandbox allows (or just to transfer data, really), and that's used extensively on *both* platforms.
--
GCP
> uses a very different architecture that does not farm out
> all requests via IPC to a broker service, but instead does the majority of the filtering inline via kernel
> facilities (namespaces, eBPF). I'll give you three guesses as to which model has better performance.
There's some misunderstanding here. On Linux desktop, Chrome does its API filtering via BPF (in seccomp) and Namespaces, with a fallback (via a setuid wrapper!) if those are not available.
But you need IPC if you need to get the remote party do something on your behalf outside of what the sandbox allows (or just to transfer data, really), and that's used extensively on *both* platforms.
--
GCP
| Topic | Posted By | Date |
|---|---|---|
| x86 - why unite when you can fragment? | anonymou5 | 2021/03/12 05:16 PM |
| x86 - why unite when you can fragment? | Linus Torvalds | 2021/03/13 12:18 PM |
| x86 - why unite when you can fragment? | Jon Masters | 2021/03/13 06:25 PM |
| x86 - why unite when you can fragment? | Jon Masters | 2021/03/13 06:44 PM |
| x86 - why unite when you can fragment? | Yuhong Bao | 2021/03/13 07:49 PM |
| x86 - why unite when you can fragment? | tt | 2021/03/20 08:30 AM |
| x86 - why unite when you can fragment? | Andrey | 2021/03/14 03:15 PM |
| x86 - why unite when you can fragment? | Linus Torvalds | 2021/03/14 03:58 PM |
| x86 - why unite when you can fragment? | anonymou5 | 2021/03/14 04:31 PM |
| x86 - why unite when you can fragment? | anon2 | 2021/03/14 07:07 PM |
| Microkernel? | Anon | 2021/03/14 10:49 PM |
| Microkernel? | none | 2021/03/14 11:37 PM |
| Microkernel? | Anon | 2021/03/15 12:56 AM |
| Microkernel? | anon2 | 2021/03/15 12:58 AM |
| Microkernel? | Simon Farnsworth | 2021/03/15 02:12 AM |
| Microkernel? | anon2 | 2021/03/15 03:53 AM |
| Microkernel? | Simon Farnsworth | 2021/03/15 05:56 AM |
| Microkernel? | iz | 2021/03/15 07:10 AM |
| Microkernel? | Anon | 2021/03/15 08:05 AM |
| Microkernel? | iz | 2021/03/16 12:25 AM |
| Microkernel? | Andrey | 2021/03/16 01:54 AM |
| Microkernel? | iz | 2021/03/16 07:36 AM |
| Microkernel? | Andrey | 2021/03/16 09:06 AM |
| Microkernel? | anonymou5 | 2021/03/16 10:44 AM |
| Microkernel? | iz | 2021/03/21 01:58 AM |
| Microkernel? | Andrey | 2021/03/21 08:34 AM |
| Microkernel? | anon2 | 2021/03/15 07:31 AM |
| Microkernel? | Simon Farnsworth | 2021/03/16 03:42 AM |
| Microkernel? | Gabriele Svelto | 2021/03/15 02:21 AM |
| Microkernel? | anon2 | 2021/03/15 03:56 AM |
| Microkernel? | Gabriele Svelto | 2021/03/15 09:41 AM |
| Microkernel? | anon2 | 2021/03/15 07:00 PM |
| Microkernel? | Gabriele Svelto | 2021/03/16 06:23 AM |
| Microkernel? | anon2 | 2021/03/16 04:13 PM |
| Microkernel? | anon2 | 2021/03/16 04:16 PM |
| Microkernel? | Gian-Carlo Pascutto | 2021/03/16 12:40 PM |
| Microkernel? | anon2 | 2021/03/16 04:53 PM |
| Microkernel? | Linus Torvalds | 2021/03/16 06:25 PM |
| Microkernel? | Doug S | 2021/03/17 08:30 AM |
| Microkernel? | Linus Torvalds | 2021/03/17 09:30 AM |
| Microkernel? | Brendan | 2021/03/17 09:56 PM |
| Microkernel? | Michael S | 2021/03/18 02:47 AM |
| Microkernel? | Brendan | 2021/03/18 08:07 AM |
| Microkernel? | Jose | 2021/03/18 08:35 AM |
| Microkernel? | zArchJon | 2021/03/18 04:42 PM |
| Transputer | RichardC | 2021/03/17 08:47 AM |
| Microkernel? | dmcq | 2021/03/17 10:15 AM |
| Microkernel? | Linus Torvalds | 2021/03/17 10:59 AM |
| Microkernel? | dmcq | 2021/03/17 11:38 AM |
| Microkernel? | Adrian | 2021/03/17 12:00 PM |
| Microkernel? | Ana R. Riano | 2021/03/18 03:33 AM |
| Microkernel? | ⚛ | 2021/04/30 03:52 PM |
| Microkernel? | NvaxPlus | 2021/03/17 10:48 AM |
| Microkernel? | Michael S | 2021/03/18 02:32 AM |
| Microkernel? | Adrian | 2021/03/18 03:12 AM |
| Microkernel? | dmcq | 2021/03/18 05:30 AM |
| Microkernel? | dmcq | 2021/03/18 05:55 AM |
| Microkernel? | Adrian | 2021/03/18 07:35 AM |
| Microkernel? | --- | 2021/03/18 08:49 AM |
| Microkernel? | dmcq | 2021/03/18 09:59 AM |
| Microkernel? | dmcq | 2021/03/18 03:09 PM |
| Microkernel? | --- | 2021/03/18 08:27 AM |
| Microkernel? | Kalle A. Sandström | 2021/03/20 05:34 AM |
| Microkernel? | --- | 2021/03/20 07:35 AM |
| Microkernel? | anon2 | 2021/03/21 04:29 PM |
| Microkernel? | dmcq | 2021/03/15 03:06 AM |
| Microkernel? | anon2 | 2021/03/15 03:59 AM |
| Microkernel? | dmcq | 2021/03/15 10:51 AM |
| Microkernel? | anon2 | 2021/03/15 07:31 PM |
| Microkernel? | dmcq | 2021/03/16 08:17 AM |
| Microkernel? | Jukka Larja | 2021/03/16 10:22 AM |
| Microkernel? | dmcq | 2021/03/16 03:06 PM |
| Microkernel? | Jukka Larja | 2021/03/17 02:42 AM |
| Microkernel? | dmcq | 2021/03/17 06:00 AM |
| Microkernel? | anon2 | 2021/03/16 04:26 PM |
| Microkernel? | --- | 2021/03/16 09:07 AM |
| Microkernel? | -.- | 2021/03/15 07:15 PM |
| Microkernel? | anon2 | 2021/03/15 08:18 PM |
| Microkernel? | Foo_ | 2021/03/16 02:37 AM |
| Read the thread (NT) | anon2 | 2021/03/16 04:27 PM |
| Already did (NT) | Foo_ | 2021/03/17 01:55 AM |
| Already did | anon2 | 2021/03/17 02:46 AM |
| Already did | Etienne Lorrain | 2021/03/18 01:31 AM |
| Microkernel? | -.- | 2021/03/17 04:04 AM |
| Microkernel? | Gabriele Svelto | 2021/03/17 07:53 AM |
| Microkernel? | -.- | 2021/03/17 01:43 PM |
| Microkernel? | dmcq | 2021/03/16 07:40 AM |
| x86 - why unite when you can fragment? | Konrad Schwarz | 2021/03/17 09:19 AM |
| x86 - why unite when you can fragment? | anonon | 2021/03/15 06:37 AM |
