On Thu, Dec 10, 2020 at 11:30:24PM +0100, Christian Brauner wrote: > (requiring btf), i.e. security_file_open, then follow > file->f_inode->i_sb->s_type->s_magic. If we change the say struct > super_block I'd expect these bpf programs to break. To break they would need to have compiled in the first place; ->s_type is struct file_system_type and it contains no ->s_magic (nor would it be possible, really - ->s_magic can vary between filesystems that *do* share ->s_type).
