Re: [RFC PATCH 06/20] bpf: lsm: Add Landlock kfuncs

[Casey Schaufler <casey@schaufler-ca.com>]

On 7/1/2026 1:02 PM, Paul Moore wrote:
> ...
>
>> Each LSM calls this once to register its sets. Because registration goes
>> through the framework, the framework gets to decide whether to actually
>> register them so you could, for example, run an LSM while explicitly
>> opting its BPF kfuncs out. (something that should be done at the LSM
>> framework level).
> I'm not opposed to the LSM supporting a set of kfuncs, see my comments
> in other threads, but we should treat these kfuncs just as we treat
> other LSM hooks today because that is what they are: LSM hooks that
> happened to be called from within a BPF program.

As someone who has been working to get the SELinux specific assumptions
out of the LSM framework for the past 15 years the notion of adding
Landlock specific interfaces makes me want to cry. Is it really that
difficult to understand that 5 or 10 years from now something is going
to come along that makes any LSM specific interface a nightmare? What
if there's an LSM that does what Landlock does, but does it better?
What if the Landlock sponsors decide to quit funding it? Or the maintainers
get bored?

I agree with Paul completely. Make the hooks available to any and all
LSMs, or don't make them at all.