Ah, yeah! There have been some new features in eBPF over the past few years, without which the bpflsm would be a lot less useful. None of this was done /specifi

Ah, yeah! There have been some new features in eBPF over the past few years, without which the bpflsm would be a lot less useful. None of this was done /specifically/ for the LSM, AFAIK, but all of it is relatively new and I think the LSM was among the first places where these things were deployed: 1) The BPF ring buffer. Previously, we had to use the perf ring buffer to get data out of the kernel, which was hard to use efficiently. 2) BTF enabled BPF programs to read kernel data structures without having to have specialized helpers defined for everything. 3) A lot of improvements to BPF itself, more powerful verifier, atomics support, etc. all enabled more useful BPF programs. AFAIK none of this had to do specifically with the LSM, but still gradually built up BPF as a viable option.