From: Paul Chaignon <paul.chaignon@gmail.com>
To: Paul Houssel <paulhoussel2@gmail.com>
Cc: paul.houssel@orange.com, "Andrii Nakryiko" <andrii@kernel.org>,
"Yonghong Song" <yonghong.song@linux.dev>,
"KP Singh" <kpsingh@kernel.org>,
"Alexei Starovoitov" <ast@kernel.org>,
"Song Liu" <song@kernel.org>,
"Martin KaFai Lau" <martin.lau@kernel.org>,
"Christian König" <christian.koenig@amd.com>,
"Florian Westphal" <fw@strlen.de>,
"T.J. Mercier" <tjmercier@google.com>,
"Li RongQing" <lirongqing@baidu.com>,
"D. Wythe" <alibuda@linux.alibaba.com>,
"Jakub Kicinski" <kuba@kernel.org>,
bpf@vger.kernel.org
Subject: Re: [PATCH 1/2] bpf: render CGROUP_LSM_NUM configurable as a KConfig
Date: Wed, 6 May 2026 14:29:14 +0200 [thread overview]
Message-ID: <afs0GuNstGXQd2E6@mail.gmail.com> (raw)
In-Reply-To: <20260506065048.592474-2-paulhoussel2@gmail.com>
On Wed, May 06, 2026 at 08:50:47AM +0200, Paul Houssel wrote:
> In include/linux/bpf-cgroup-defs.h, CGROUP_LSM_NUM defines the maximum
> number of BPF_PROG_TYPE_LSM programs that can be simultaneously attached
> using the `BPF_LSM_CGROUP` attachment type. We set the value to the newly
> introduced `CONFIG_CGROUP_LSM_NUM` Kconfig option, allowing users and
> distributions to tune this limit at build time rather than relying on a
> hardcoded value.
>
> The option ranges from 0 to 300 and defaults to 10, preserving the
> existing behaviour. There are currently 273 LSM hooks but this number is
> subject to change. I coudn't find a MACRO counting the sum of LSM
> interfaces and therefore arbitrarily set the threshold to 300. I am open
> to suggestions on how to set this limit dynamically or not.
For reference, there was a discussion on this previously at
https://lore.kernel.org/bpf/20220408225628.oog4a3qteauhqkdn@kafai-mbp.dhcp.thefacebook.com/
>
> ---
Your SOB isn't detected because of the above separation. Text between
the "---" and the diff is ignored by git.
It's probably also worth cc'ing Stanislav Fomichev when sending the v2.
pw-bot: cr
next prev parent reply other threads:[~2026-05-06 12:29 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-05-06 6:50 [PATCH 0/2] Introduce CONFIG_CGROUP_LSM_NUM to render BPF_LSM_CGROUP attachment limit configurable Paul Houssel
2026-05-06 6:50 ` [PATCH 1/2] bpf: render CGROUP_LSM_NUM configurable as a KConfig Paul Houssel
2026-05-06 12:29 ` Paul Chaignon [this message]
2026-05-06 6:50 ` [PATCH 2/2] selftests/bpf: add tests to verify the enforcement of CONFIG_CGROUP_LSM_NUM Paul Houssel
2026-05-06 13:15 ` Paul Chaignon
2026-05-06 13:25 ` polo
2026-05-06 18:41 ` sashiko-bot
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=afs0GuNstGXQd2E6@mail.gmail.com \
--to=paul.chaignon@gmail.com \
--cc=alibuda@linux.alibaba.com \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=christian.koenig@amd.com \
--cc=fw@strlen.de \
--cc=kpsingh@kernel.org \
--cc=kuba@kernel.org \
--cc=lirongqing@baidu.com \
--cc=martin.lau@kernel.org \
--cc=paul.houssel@orange.com \
--cc=paulhoussel2@gmail.com \
--cc=song@kernel.org \
--cc=tjmercier@google.com \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox