Re: [PATCH bpf-next 1/2] lsm: add bpf_security_locked_down() kfunc

> lsm: add bpf_security_locked_down() kfunc
>
> Add a new kfunc bpf_security_locked_down, which calls
> security_locked_down and returns the result.
>
> Create a new file security/lsm_kfuncs.c for LSM framework kfuncs.
>
> Reject reasons outside (LOCKDOWN_NONE, LOCKDOWN_CONFIDENTIALITY_MAX)
> with -EINVAL before dispatching the hook. Limit the kfunc to
> BPF_PROG_TYPE_LSM and BPF_PROG_TYPE_SYSCALL programs, and refuse it
> to programs attached to the locked_down hook itself, which would
> recurse into the dispatch.
>
> Signed-off-by: Justin Suess <[email protected]>

This isn't a bug, but could the changelog lead with the use case that
motivates exposing security_locked_down() to BPF programs, instead of
restating what each hunk does?


---
AI reviewed your patch. Please fix the bug or email reply why it's not a bug.
See: https://github.com/kernel-patches/vmtest/blob/master/ci/claude/README.md

CI run summary: https://github.com/kernel-patches/bpf/actions/runs/31882515336