2 ms·

How is the cache invalidated when: - The permissions change? - Directories are moved? - Hard-links are added? - Things are deleted? Also: Is the cache limited i

• gnoack 12d ago
  I'd also be interested in this, particularly in the "move" case, which requires no privileges and can also happen without the kernel being in the loop (e.g. on a different machine, in NFS). If your calculated policy is a function of the entire path, you'd normally need to key the calculated policy by the entire path and its relevant properties (underlying inodes) as well, no? There are path-based LSMs in the Linux kernel that do not employ such caching. If you found a solution for this which also works in the corner cases and results in speed-up in real life scenarios, I'd be interested :)
• psd1 12d ago
  Link with the answers: https://nathannaveen.dev/posts/dropping-ebpf-cpu-cost-by-90/ https://nathannaveen.dev/posts/dropping-ebpf-cpu-cost-by-90/
• WhenItRuns 11d ago
  [flagged]