[PATCH v2 0/5] rust: lsm: introduce safe Rust abstractions for the LSM framework

[Jamie Lindsey]

On Wed, Mar 11, 2026 at 07:48:57AM +0100, Alice Ryhl wrote:
> What is the intended end-user of these abstractions?

The intended end-user is a real, policy-enforcing LSM for autonomous
agent workloads -- not the sample module included in this series.

I'm building an agent-native security module that enforces capability
manifests at the kernel level: per-agent file access policy, network
destination restrictions, process spawn depth limits, and pre-exec
threat detection. The agent identity is tracked via the LSM security
blob on struct cred, and policy decisions are made per-hook based on
compiled manifest rules.

The sample LSM in patch 4 exists as a boot-test vehicle for the
abstractions, not as the target consumer. I should have made that
clearer in the cover letter -- that's on me.

Regarding Paul's point about example LSMs: understood completely.
I'll rework the series to present the abstractions alongside the
real LSM rather than the sample. I'll review the prior work Paul
linked and the new-LSM guidance before resubmitting.

Thanks to both of you for the fast feedback.

Jamie