Can we block splice syscall?

--0000000000004244f2065162a9fd
Content-Type: text/plain; charset="UTF-8"

Considering that "dirty frag" and "copy fail" are probably just the
beginning, and splice is a Linux specific syscall which just
enhances performance, no new function per se, could we just disable it
somehow?
There is no sysctl for that (like io_uring), seccomp cannot be applied
globally, it is not possible to block splice() directly with AppArmor or
SELinux, blocking accesses to pipes globally would render the OS unusable...
Do we have to write a dedicated LSM?

--0000000000004244f2065162a9fd
Content-Type: text/html; charset="UTF-8"
Content-Transfer-Encoding: quoted-printable

<div dir=3D"ltr"><div>Considering that &quot;dirty frag&quot; and &quot;cop=
y fail&quot; are probably just the beginning, and splice is a Linux specifi=
c syscall which just enhances=C2=A0performance, no new function=C2=A0per se=
, could we just disable it somehow?</div><div>There is no sysctl for that (=
like io_uring), seccomp cannot be applied globally, it is not possible to b=
lock splice() directly with AppArmor or SELinux, blocking accesses to pipes=
 globally would render the OS unusable...<br></div><div>Do we have to write=
 a dedicated LSM?</div><div><br></div><div><br></div></div>

--0000000000004244f2065162a9fd--