They're far from guaranteed to catch things they monitor anyway, and I feel they mostly just exist to let enterprise pretend they care about security by buying ineffective band aids and duct tape. I guess a legal defense is more important than a technical one.
I think you under estimate the value of anti-virus. Anti virus software is a good second line of defense. It’s not perfect but it will stop a lot of known malware. This has value.[0] page 11 https://services.google.com/fh/files/misc/m-trends-2025-en.p... [1] https://news.ycombinator.com/item?id=41002195
Anything novel will fly right past it, and it will have false positives. Plastering ineffective or mildly effective security everywhere in the name of "defense in depth" can have negative value as it reduces diligence in applying more relevant security measures that aren't just a random package install.
1. The program can only do what it is permitted to do: io_uring just reduces the number of system calls required - but since it works on file descriptors, you must have already acquired the fd in the correct mode.
2. Some monitoring systems hook into system calls and report when they are used: io_uring and opcodes mean the program can perform actions without being noticed by these programs...
3. ...which can report on the use of the system calls that set up io_uring access...
4. ...and could report on the resuting I/O by other means.
I won’t go so far as to say this is a nothing burger, but it feels close.
With the caveat that you can open files through io_uring requests, too: https://www.man7.org/linux/man-pages/man3/io_uring_prep_open...
And they might not have traditional FDs: https://lwn.net/Articles/863071/
But yes, it's bad security architecture (fail-open), not updated fast enough.
The real answer is probably something more like Landlock, where it's the kernel's job to understand syscall semantics.
* fast
* secure
* easy