Re: [PATCH v3 0/2] Introduce CONFIG_CGROUP_LSM_NUM to render BPF_LSM_CGROUP attachment limit configurable

[Paul Chaignon <paul.chaignon@gmail.com>]

On Wed, May 06, 2026 at 05:05:45PM +0200, Paul Houssel wrote:
> In include/linux/bpf-cgroup-defs.h, CGROUP_LSM_NUM defines the maximum
> number of BPF_PROG_TYPE_LSM programs that can be simultaneously attached
> using the BPF_LSM_CGROUP attachment type. It is currently hardcoded to 10.
> 
> This limit was introduced in 'commit c0e19f2c9a3e ("bpf: minimize number
> of allocated lsm slots per program")' in the first patch implementing
> BPF_LSM_CGROUP attachment, and has not been changed since. Rather than
> reserving one slot per LSM hook (a 1:1 static mapping across all 211
> possible available hooks at that time), it introduced a dynamic scheme
> where only 10 slots exist per cgroup allocated on demand.
> 
> In practice, eBPF-based tools may exceed this limit. I therefore propose
> making CGROUP_LSM_NUM a Kconfig option so that users can tune it to their
> requirements, rather than being constrained by static hardcoded default
> that has been arbitrarily decided on the first implementation of this
> attachment type. On the other hand some uses cases may be interest to
> limit the number of attachments to a lower value than 10 to prevent too
> much memory overhead.
> 
> Modifying this limit has been dicussed previously in
> https://lore.kernel.org/bpf/20220408225628.oog4a3qteauhqkdn@kafai-mbp.dhcp.thefacebook.com/,
> where the same thought on this limit being too small was being shared as
> well. Furthermore, this discussion seems to have yielded inconclusive
> about to render it dynamic, without a fixed array size.
> 
> Changes since V3:
> 	- refactor test eBPF programs by using a macro (patch 2)
> 	- improve the kconfig help text by elaborating on the memory
> 	  overhead (patch 1)
> 	- link to V2:
> 	https://lore.kernel.org/bpf/20260506131257.713895-1-paulhoussel2@gmail.com/

We typically keep the full changelogs (with each version). That can
help among other things to get a sense of whether the reviews are
converging.

> 
> 
> 
> Paul Houssel (2):
>   bpf: render CGROUP_LSM_NUM configurable as a KConfig
>   selftests/bpf: add tests to verify the enforcement of
>     CONFIG_CGROUP_LSM_NUM
> 
>  include/linux/bpf-cgroup-defs.h               |  2 +-
>  kernel/bpf/Kconfig                            | 19 ++++++
>  tools/testing/selftests/bpf/config            |  1 +
>  .../selftests/bpf/prog_tests/cgroup_lsm_num.c | 60 +++++++++++++++++++
>  .../selftests/bpf/progs/cgroup_lsm_num.c      | 46 ++++++++++++++
>  5 files changed, 127 insertions(+), 1 deletion(-)
>  create mode 100644 tools/testing/selftests/bpf/prog_tests/cgroup_lsm_num.c
>  create mode 100644 tools/testing/selftests/bpf/progs/cgroup_lsm_num.c
> 
> -- 
> 2.54.0
>