Deep argument inspection for seccomp

From what I understood, the primary concern of "exposing internals" is that the implementation details of the LSM hook infrastructure might become a user-space ABI (and thus must not be broken). Currently, LSM hooks can be redesigned within the kernel because all of the LSM hook users are also in-kernel. If you allow eBPF programs to be attached as LSM hooks, then you can no longer redesign the API as easily because you will break user-space unless you provide backwards-compatible shims.

And note that Linus recently said he feels that eBPF *tracepoints* are an ABI[1].

[1]: https://lwn.net/Articles/799262/