On 2/20/2020 9:52 AM, KP Singh wrote: > From: KP Singh <kpsingh@xxxxxxxxxx> Again, apologies for the CC list trimming. > > # v3 -> v4 > > https://lkml.org/lkml/2020/1/23/515 > > * Moved away from allocating a separate security_hook_heads and adding a > new special case for arch_prepare_bpf_trampoline to using BPF fexit > trampolines called from the right place in the LSM hook and toggled by > static keys based on the discussion in: > > https://lore.kernel.org/bpf/CAG48ez25mW+_oCxgCtbiGMX07g_ph79UOJa07h=o_6B6+Q-u5g@xxxxxxxxxxxxxx/ > > * Since the code does not deal with security_hook_heads anymore, it goes > from "being a BPF LSM" to "BPF program attachment to LSM hooks". I've finally been able to review the entire patch set. I can't imagine how it can make sense to add this much complexity to the LSM infrastructure in support of this feature. There is macro magic going on that is going to break, and soon. You are introducing dependencies on BPF into the infrastructure, and that's unnecessary and most likely harmful. Would you please drop the excessive optimization? I understand that there's been a lot of discussion and debate about it, but this implementation is out of control, disruptive, and dangerous to the code around it.
