[PATCH bpf-next v3 04/15] lsm: Add the bpf_lsm_policy_release kfunc and policy object destructor

[Alexei Starovoitov]

On Sun, Sep 13, 2026 at 5:20 PM Justin Suess <utilityemal77 at gmail.com> wrote:
>
> Sure, in some perfect world in the future where every verifier
> challenge is solved and BPF has feature parity with in-tree c on
> a 1:1 basis, you could implement something like SELinux, or Landlock
> in pure eBPF.

Try.. give it a shot? What is missing in the verifier?

> Why force every eBPF program that needs to make security
> decisions to reeinvent the wheel?

What specific reinvention are you talking about?

> BPF already calls into LSM through security hooks. This is no
> different than bpf_map_create hooks.

what? It doesn't. bpf progs avoid lsm hooks as a plague.
Not a single kfuncs calls into lsm directly.
It may call into security_*() by accident because
it calls some kernel mechanisms.

> Nothing about the way BPF works changes with this patchset.
> There's no verifier internal changes.

If the verifier is in the way of what you want to accomplish
then please improve it.