[PATCH bpf-next 0/4] Reduce overhead of LSMs with static calls

[KP Singh]

On Wed, Jul 26, 2023 at 1:07 PM Paolo Abeni <pabeni at redhat.com> wrote:
>
> Hi all,
>
> On Tue, 2023-06-20 at 19:40 -0400, Paul Moore wrote:
> > On Tue, Jun 13, 2023 at 6:03 PM KP Singh <kpsingh at kernel.org> wrote:
> > > I tried proposing an idea in
> > > https://patchwork.kernel.org/project/netdevbpf/patch/20220609234601.2026362-1-kpsingh@kernel.org/
> > >  as an LSM_HOOK_NO_EFFECT but that did not seemed to have stuck.
> >
> > It looks like this was posted about a month before I became
> > responsible for the LSM layer as a whole, and likely was lost (at
> > least on the LSM side of things) as a result.
> >
> > I would much rather see a standalone fix to address the unintended LSM
> > interactions, then the static call performance improvements in a
> > separate patchset.
>
> Please allow me to revive this old thread. I learned about this effort
> only recently and I'm interested into it.
>
> Looking at patch 4/4 from this series, it *think* it's doable to
> extract it from the series and make it work standalone. If so, would
> that approach be ok from a LSM point of view?

I will rev up the series again. I think it's worth fixing both issues
(performance and this side-effect). There are more users who have been
asking me for performance improvements for LSMs

>
> One thing that I personally don't understand in said patch is how the
> '__ro_after_init' annotation for the bpf_lsm_hooks fits the run-time
> 'default_state' changes?!?
>
> Cheers,
>
> Paolo
>