lockc-project / lockc

Making containers more secure with eBPF and Linux Security Modules (LSM)
https://lockc-project.github.io/
Apache License 2.0
218 stars 19 forks source link

Use LPM_TRIE maps in sb_mount LSM hook #134

Open vadorovsky opened 2 years ago

vadorovsky commented 2 years ago

Currently we put allowed mount paths in a BPF hash map, where those paths are values and for cheching each mount, we iterate over that whole map and search for the string match. Not very optimal.

Instead, we should try to use LPM_TRIE maps which allow to match the prefix in optimal way: