73% of What We Blocked in a Month Was One Syscall Your Sandbox Cannot See

说明与用途

在 seccomp 沙箱中阻止 io_uring_setup 可以消除 AI 代理隐藏 I/O 操作的主要盲点，牺牲性能以提升安全可见性。

问题

Seccomp-based sandboxes cannot detect io_uring operations, allowing unmonitored I/O that bypasses syscall-level security policies.

结果

Blocking io_uring_setup eliminates a major blind spot in seccomp sandboxes, ensuring all I/O operations are observable and scored. AI agents lose performance but gain security visibility.

工作流

• 1. Run AI agent inside a seccomp sandbox.
• 2. Agent attempts io_uring_setup to create a ring.
• 3. Sandbox allows the syscall, ring is created.
• 4. Agent submits I/O operations via the ring, no further syscalls.
• 5. Seccomp filter cannot see these operations, bypassing security checks.
• 6. Grith intercepts syscalls and denies io_uring_setup before scoring.
• 7. Agent falls back to standard syscalls (openat, connect) which are monitored.

证据

73% of everything we blocked was a single syscall: io_uring_setup.

来源

Docker blocks the io_uring syscalls in its default seccomp profile as of 25.0.

来源

grith denies io_uring_setup structurally, before it is ever scored.

来源