On Mon, Apr 8, 2024 at 7:09 PM KP Singh <kpsingh@xxxxxxxxxx> wrote: > > > > > On 25 Mar 2024, at 10:56, Xu Kuohai <xukuohai@xxxxxxxxxxxxxxx> wrote: > > > > From: Xu Kuohai <xukuohai@xxxxxxxxxx> > > > > Add return value descriptions for lsm hook. > > > > Two integer ranges are added: > > > > 1. ERRNO: Integer between -MAX_ERRNO and 0, including -MAX_ERRNO and 0. I also don't really like these special macros that imply a range. Why not do something like? LSM_RET_INT(default, min, max) You seemed to have missed the values returned by these hooks: security_inode_need_killpriv security_inode_getsecurity security_inode_listsecurity security_inode_copy_up_xattr security_task_prctl security_getprocattr securitty_setprocattr ^^these two we should just disable in BPF LSM security_ismaclabel ^^probably even this There seem to be only a handful of these. Can we just manage it with a BTF set on the BPF side? - KP > > 2. ANY: Any integer > > > I think you should merge this patch and the first patch. It's not clear that the first value in this macro is actually used as the default value until one reads the code. I think you also need to make it clear that there is no logical change on the LSM side in the this patch. > > - KP
