Re: [RFC PATCH] security: Allow dropping bounding set process-wide

["Serge E. Hallyn" <serge@hallyn.com>]

On Mon, Sep 28, 2026 at 11:10:14AM +0800, Jinjie Ruan wrote:
> 
> 
> 在 2026/9/25 22:34, Serge E. Hallyn 写道:
> > Jinjie, could you reproduce your timing experiments against the
> > SetProc code?
> 
> Hi Serge, the test result is as below:

Thanks!

> |   method      |   Description                                       |
> | ------------- | --------------------------------------------------- |
> | baseline	| Per-cap syscall.AllThreadsSyscall6(PR_CAPBSET_DROP),|
> |               |   the original gVisor implementation                |
> | dropbound	| libcap cap.DropBound() (library API, per-thread)    |
> | SetProc	| cap.IABGetProc() + SetVector(Bound) + SetProc()     |
> | SetProc-min	| Minimal IAB with the read overhead removed: NewIAB()|
> |               |  + SetVector(Bound) + SetProc()                     |
> | mask	        | prctl(PR_CAPBSET_DROP_MASK, lo, hi)                 |
> 
> All variants uniformly drop all 41 caps (cap_last_cap = 40), and both
> the success rate and dropped are verified.
> 
> Sampling scale:
> - Patched guest, 8 vCPU: 2 boots × 21 runs = 42 runs/point, 1050 samples
> total;
> - Patched guest, 32 vCPU: 21 runs per point, 525 samples total.
> 
> Mean in µs bucketed by actual thread count (sample count in parentheses)
> 
> ## 8 vCPU (42 samples per point)
> 
> method	     8–15	16–31	      32–63	   64–95
> baseline    3258.9(41)	6955.9(43)   10303.9(84)   14394.3(42)
> dropbound   3356.3(41)	5048.1(43)   9914.3(84)	   16837.1(42)
> SetProc	    3365.4(41)	6255.4(43)   10179.4(84)   16799.8(42)
> SetProc-min 3485.0(41)	5603.9(43)   10533.2(84)   15146.8(42)
> mask	    68.2(42)	92.3(42)     224.2(84)	   433.7(42)
> 
> ## 32 vCPU (21 samples per point)
> 
> method	      8–15	 16–31	       32–63	      64–95
> baseline     8422.4(20)	 8491.8(22)   17814.2(42)    21612.6(21)
> dropbound    5235.5(21)	 7568.9(21)   17350.8(42)    21205.5(21)
> SetProc	     5540.8(21)	 8159.2(21)   17920.5(42)    22168.3(21)
> SetProc-min  5582.8(20)	 7907.7(22)   15136.0(42)    22334.5(21)
> mask	     114.6(21)	 181.8(21)    428.5(42)      684.7(21)
> 
> So IAB.SetProc is not an optimization. Like the gVisor baseline, it

Oh, I could be wrong, but I didn't think Andrew meant that it was
an optimization.  Rather, it was correct, and possibly complicated
or fragile enough that it belongs more in userspace than kernel.

Looking forward to seeing the updated design.

> issues one PR_CAPBSET_DROP per capability on every thread
> (syscall.AllThreadsSyscall); averaged over multiple repeated groups, it
> is on the same order of magnitude as the baseline, or even slower.
> 
> > 
> > On Tue, Sep 22, 2026 at 07:10:11PM -0700, Andrew G. Morgan wrote:
> >> The https://pkg.go.dev/kernel.org/pub/linux/libs/security/libcap/cap#IAB.SetProc
> >> already handles this for the whole process. It can be run from main()
> >> if you need it to happen early, and it will track down all of the
> >> threads in the runtime.
> >>
> >> To Serge's point, I am also curious what benefit there is from doing
> >> it more quickly. After all, this is pretty much a one-time function
> >> request for any executable.
> >>
> >> FYI The "sendmail capabilities bug" reference is written up here:
> >> https://sites.google.com/site/fullycapable/thesendmailcapabilitiesissue
> >>
> >> Cheers
> >>
> >> Andrew

thanks,
-serge