On Wed, Jun 19, 2024 at 12:38 PM Roberto Sassu
[off-list ref] wrote:

Making it a kernel subsystem would likely mean replicating what the LSM
infrastructure is doing, inode (security) blob and being notified about
file/directory changes.

Just because the LSM framework can be used for something, perhaps it
even makes the implementation easier, it doesn't mean the framework
should be used for everything.

-- 
paul-moore.com