{"action":"reopened","issue":{"url":"https://api.github.com/repos/oscarlab/graphene/issues/5","repository_url":"https://api.github.com/repos/oscarlab/graphene","labels_url":"https://api.github.com/repos/oscarlab/graphene/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/oscarlab/graphene/issues/5/comments","events_url":"https://api.github.com/repos/oscarlab/graphene/issues/5/events","html_url":"https://github.com/oscarlab/graphene/issues/5","id":172782423,"number":5,"title":"How the direct syscalls are handled?","user":{"login":"jsakkine","id":112336,"avatar_url":"https://avatars.githubusercontent.com/u/112336?v=3","gravatar_id":"","url":"https://api.github.com/users/jsakkine","html_url":"https://github.com/jsakkine","followers_url":"https://api.github.com/users/jsakkine/followers","following_url":"https://api.github.com/users/jsakkine/following{/other_user}","gists_url":"https://api.github.com/users/jsakkine/gists{/gist_id}","starred_url":"https://api.github.com/users/jsakkine/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jsakkine/subscriptions","organizations_url":"https://api.github.com/users/jsakkine/orgs","repos_url":"https://api.github.com/users/jsakkine/repos","events_url":"https://api.github.com/users/jsakkine/events{/privacy}","received_events_url":"https://api.github.com/users/jsakkine/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":1,"created_at":"2016-08-23T19:14:03Z","updated_at":"2016-08-23T19:25:03Z","closed_at":null,"body":"Hi\r\n\r\nI'm the lead developer for the SGX driver that we are eventually trying to upstream. I just recently studied your project and one question popped into my mind.\r\n\r\nCouldn't you bypass your sandbox by directly inserting SYSENTER opcode to the program instead of using libc to make the syscall? Of course with SGX this would not be possible because that would\r\ncause #GP.\r\n\r\nIn order to fight against such attempts two options come up to my mind:\r\n\r\n- Patch the binary. This is BTW something that Chromium used to do some years ago for JIT before seccomp filters came around.\r\n- Block all direct system calls with a seccomp filter. This would thrawt the promise to run unmodified binaries.\r\n\r\nIf you have a solution for this issue, maybe it would be good to explain in the wiki because this is really the very first question that popped up when I ready it through."}}
{"actor":{"display_login":"chiache"}}