How is the cache invalidated when:
- The permissions change?
- Directories are moved?
- Hard-links are added?
- Things are deleted?
Also: Is the cache limited in size?
If your calculated policy is a function of the entire path, you'd normally need to key the calculated policy by the entire path and its relevant properties (underlying inodes) as well, no?
There are path-based LSMs in the Linux kernel that do not employ such caching. If you found a solution for this which also works in the corner cases and results in speed-up in real life scenarios, I'd be interested :)