Re: [PATCH 2/2] kernel/entry: add kernel.syscall_user_dispatch sysctl

[Gregory Price]

> > +	/* Arming can be denied at runtime via sysctl, disarming is allowed */
> > +	if (mode != PR_SYS_DISPATCH_OFF && !syscall_user_dispatch_allowed)
> > +		return -EPERM;
> 
> That might be similar to other sysctls, but if an application had it
> enabled prior to the sysctl=off toggle, then that application will
> suddenly fail in operation if it requires to move the dispatch window.
>

If the admin is turning it off globally, is that not exactly what the
admin wants?  The alternative is a hard disable that will simply result
in undefined behavior (windows syscall ABI being interpreted at a linux
syscall) instead of failing gracefully on the re-arm.

This seemed like the better option.

~Gregory