There are two groups of LSM hooks under Security hooks for inode operations: inode_* and path_*. Many of them look identical. For example, inode_link and path_link.
What is the difference between the inode and path hooks? When each should be used?
1 Answer
Path hooks were added by TOMOYO maintainers, to allow file path calculation in LSM module.
These hooks receive a pointer to path struct. inode hooks resides on a lower level, and receive a pointer to inode struct. The file path cannot be retrieved from this struct.
Generally speaking, if you don't need the file path you should use inode hooks since they are called on a lower level. It means that your hook will be called less frequently. Note that path hooks are compiled only if the kernel is compiled with CONFIG_SECURITY_PATH.