On 2026-10-21, Gabriele Monaco <[email protected]> wrote: >> BTW, I'm curious if it isn't possible to keep both in-kernel and BPF >> monitors? That is, for those cases that do not change often and has a >> well known model, to simply keep those as modules and hard coded. > > In my opinion it is possible and I'm designing every change with that > coexistence in mind. > > I would say we could only drop in-kernel if BPF does such a great job > to cover every single technical and non-technical requirement or > use-case, AND if it makes maintaining the whole thing easier.
I am wondering if coexistence should be the goal. For example, the monitor classes (DA, LTL, HTA) are only implemented in the kernel and provide kfuncs for the state transition functions to be available to BPF monitors. I would expect that this would allow BPF monitors to have the full functionality as in-kernel monitors, since the events, errors, and reactors would all trigger from the monitor class code. John
