On Wed, Jul 26, 2023 at 1:07 PM Paolo Abeni [off-list ref] wrote:

Hi all,

On Tue, 2023-06-20 at 19:40 -0400, Paul Moore wrote:

quoted

On Tue, Jun 13, 2023 at 6:03 PM KP Singh [off-list ref] wrote:

quoted

I tried proposing an idea in
https://patchwork.kernel.org/project/netdevbpf/patch/20220609234601.2026362-1-kpsingh@kernel.org/
 as an LSM_HOOK_NO_EFFECT but that did not seemed to have stuck.

It looks like this was posted about a month before I became
responsible for the LSM layer as a whole, and likely was lost (at
least on the LSM side of things) as a result.

I would much rather see a standalone fix to address the unintended LSM
interactions, then the static call performance improvements in a
separate patchset.

Please allow me to revive this old thread. I learned about this effort
only recently and I'm interested into it.

Looking at patch 4/4 from this series, it *think* it's doable to
extract it from the series and make it work standalone. If so, would
that approach be ok from a LSM point of view?

I will rev up the series again. I think it's worth fixing both issues
(performance and this side-effect). There are more users who have been
asking me for performance improvements for LSMs

One thing that I personally don't understand in said patch is how the
'__ro_after_init' annotation for the bpf_lsm_hooks fits the run-time
'default_state' changes?!?

Cheers,

Paolo