"'[…]this whole "nested LSM" stuff as a design goal just needs to be all rolled back, and the new design target is "one LSM, enabled statically at build time, without the need for indirect calls."
Because we're now in the situation where the security hooks are actually a source of not just horrible performance issues, but also actual insecurity[…]"'
