Deep argument inspection for seccomp [LWN.net]

Deep argument inspection for seccomp

Posted Sep 19, 2019 12:19 UTC (Thu) by gnoack (subscriber, #131611)
Parent article: Deep argument inspection for seccomp

The article says that the Landlock approach "exposes LSM internals that the LSM developers are not comfortable exposing."

Which LSM internals are that, which they aren't comfortable exposing? (Sorry, I must have missed the discussion.) Is that a concern for other proposed LSMs as well?

to post comments

Deep argument inspection for seccomp

Posted Sep 19, 2019 12:31 UTC (Thu) by cyphar (subscriber, #110703) [Link]

From what I understood, the primary concern of "exposing internals" is that the implementation details of the LSM hook infrastructure might become a user-space ABI (and thus must not be broken). Currently, LSM hooks can be redesigned within the kernel because all of the LSM hook users are also in-kernel. If you allow eBPF programs to be attached as LSM hooks, then you can no longer redesign the API as easily because you will break user-space unless you provide backwards-compatible shims.

And note that Linus recently said he feels that eBPF *tracepoints* are an ABI[1].

[1]: https://lwn.net/Articles/799262/