This mechanism was inspired by NSA. As described all hooks stored in huge struct security_hooks_list, but it`s format is different in each version. We can determine which list belongs to what hook with disasm magic. Lets see function that calls security hooks - for example security_path_chown:
.text:FFFFFFC010496448 security_path_chown ; CODE XREF: chown_common+104↑p.text:FFFFFFC010496448 STP X29, X30, [SP,#-0x18+var_18]!.text:FFFFFFC01049644C MOV X29, SP.text:FFFFFFC010496450 STP X20, X21, [SP,#0x18+var_s0].text:FFFFFFC010496454 STR X22, [SP,#0x18+var_s10].text:FFFFFFC010496458 MOV X20, path.text:FFFFFFC01049645C MOV W21, W1.text:FFFFFFC010496460 MOV path, X30.text:FFFFFFC010496464 MOV W22, W2.text:FFFFFFC010496468 loc_FFFFFFC010496468 ; DATA XREF: .init.data:FFFFFFC0111474C0↓o.text:FFFFFFC010496468 BL _mcount.text:FFFFFFC01049646C LDR X0, [path,#8].text:FFFFFFC010496470 LDR X0, [X0,#0x30].text:FFFFFFC010496474 LDR W0, [X0,#0xC].text:FFFFFFC010496478 TBNZ W0, #9, loc_FFFFFFC0104964B4.text:FFFFFFC01049647C ADRP X0, #security_hook_heads_0.path_chown@PAGE.text:FFFFFFC010496480 STR X19, [X29,#0x18+var_8].text:FFFFFFC010496484 LDR X19, [X0,#security_hook_heads_0.path_chown@PAGEOFF]
sudo ./lkmem -d -c -S ~/krnl/curr ~/krnl/System.map-5.11.0-37-genericptrace_access_check: 3 0xffffffff964ae400 - kernel!cap_ptrace_access_check 0xffffffff96515a40 - kernel!yama_ptrace_access_check 0xffffffff96506770 - kernel!apparmor_ptrace_access_checkptrace_traceme: 3 0xffffffff964ae380 - kernel!cap_ptrace_traceme 0xffffffff965159a0 - kernel!yama_ptrace_traceme 0xffffffff965065e0 - kernel!apparmor_ptrace_tracemecapget: 2 0xffffffff964ad960 - kernel!cap_capget 0xffffffff96505a90 - kernel!apparmor_capgetcapset: 1 0xffffffff964ae490 - kernel!cap_capsetcapable: 2 0xffffffff964ada50 - kernel!cap_capable 0xffffffff96505780 - kernel!apparmor_capablebprm_creds_for_exec: 1 0xffffffff964fcc60 - kernel!apparmor_bprm_creds_for_execbprm_creds_from_file: 1 0xffffffff964ae8e0 - kernel!cap_bprm_creds_from_filebprm_committing_creds: 1 0xffffffff96504bc0 - kernel!apparmor_bprm_committing_credsbprm_committed_creds: 1 0xffffffff965054d0 - kernel!apparmor_bprm_committed_credssb_mount: 1 0xffffffff96506ab0 - kernel!apparmor_sb_mountsb_umount: 1 0xffffffff96505c10 - kernel!apparmor_sb_umountsb_pivotroot: 1 0xffffffff965070d0 - kernel!apparmor_sb_pivotrootpath_unlink: 1 0xffffffff965065a0 - kernel!apparmor_path_unlinkpath_mkdir: 1 0xffffffff965064c0 - kernel!apparmor_path_mkdirpath_rmdir: 1 0xffffffff965065c0 - kernel!apparmor_path_rmdirpath_mknod: 1 0xffffffff965064f0 - kernel!apparmor_path_mknodpath_truncate: 1 0xffffffff965063b0 - kernel!apparmor_path_truncatepath_symlink: 1 0xffffffff96506490 - kernel!apparmor_path_symlinkpath_link: 1 0xffffffff96508060 - kernel!apparmor_path_linkpath_rename: 1 0xffffffff96508210 - kernel!apparmor_path_renamepath_chmod: 1 0xffffffff965063f0 - kernel!apparmor_path_chmodpath_chown: 1 0xffffffff965063d0 - kernel!apparmor_path_chowninode_getattr: 1 0xffffffff96506390 - kernel!apparmor_inode_getattrinode_need_killpriv: 1 0xffffffff964ad990 - kernel!cap_inode_need_killprivinode_killpriv: 1 0xffffffff964ad9c0 - kernel!cap_inode_killprivinode_getsecurity: 1 0xffffffff964ae010 - kernel!cap_inode_getsecurityfile_permission: 1 0xffffffff96506120 - kernel!apparmor_file_permissionmmap_addr: 1 0xffffffff964ade10 - kernel!cap_mmap_addrmmap_file: 2 0xffffffff964ad930 - kernel!cap_mmap_file 0xffffffff965060e0 - kernel!apparmor_mmap_filefile_mprotect: 1 0xffffffff96506090 - kernel!apparmor_file_mprotectfile_lock: 1 0xffffffff96506020 - kernel!apparmor_file_lockfile_receive: 1 0xffffffff96506140 - kernel!apparmor_file_receivefile_open: 1 0xffffffff965078c0 - kernel!apparmor_file_opentask_alloc: 1 0xffffffff96505110 - kernel!apparmor_task_alloctask_free: 2 0xffffffff96515320 - kernel!yama_task_free 0xffffffff965056c0 - kernel!apparmor_task_freecred_alloc_blank: 1 0xffffffff965046b0 - kernel!apparmor_cred_alloc_blankcred_free: 1 0xffffffff965055c0 - kernel!apparmor_cred_freetask_fix_setuid: 1 0xffffffff964ade60 - kernel!cap_task_fix_setuidtask_getsecid: 1 0xffffffff96505570 - kernel!apparmor_task_getsecidtask_setnice: 1 0xffffffff964ae370 - kernel!cap_task_setnicetask_setioprio: 1 0xffffffff964ae360 - kernel!cap_task_setiopriotask_setrlimit: 1 0xffffffff96505d50 - kernel!apparmor_task_setrlimittask_setscheduler: 1 0xffffffff964ae350 - kernel!cap_task_setschedulertask_kill: 1 0xffffffff96507b40 - kernel!apparmor_task_killtask_prctl: 2 0xffffffff964adb10 - kernel!cap_task_prctl 0xffffffff965155d0 - kernel!yama_task_prctlsetprocattr: 1 0xffffffff96508c50 - kernel!apparmor_setprocattrsecctx_to_secid: 1 0xffffffff96509a70 - kernel!apparmor_secctx_to_secidrelease_secctx: 1 0xffffffff96509ac0 - kernel!apparmor_release_secctxunix_stream_connect: 1 0xffffffff96507260 - kernel!apparmor_unix_stream_connectunix_may_send: 1 0xffffffff96506900 - kernel!apparmor_unix_may_sendsocket_create: 1 0xffffffff96507e50 - kernel!apparmor_socket_createsocket_post_create: 1 0xffffffff96508490 - kernel!apparmor_socket_post_createsocket_bind: 1 0xffffffff96504e10 - kernel!apparmor_socket_bindsocket_connect: 1 0xffffffff96504dd0 - kernel!apparmor_socket_connectsocket_listen: 1 0xffffffff96504da0 - kernel!apparmor_socket_listensocket_accept: 1 0xffffffff96504d70 - kernel!apparmor_socket_acceptsocket_sendmsg: 1 0xffffffff96505070 - kernel!apparmor_socket_sendmsgsocket_recvmsg: 1 0xffffffff96504d20 - kernel!apparmor_socket_recvmsgsocket_getsockname: 1 0xffffffff96504cb0 - kernel!apparmor_socket_getsocknamesocket_getpeername: 1 0xffffffff96504c90 - kernel!apparmor_socket_getpeernamesocket_getsockopt: 1 0xffffffff965050c0 - kernel!apparmor_socket_getsockoptsocket_setsockopt: 1 0xffffffff96504cd0 - kernel!apparmor_socket_setsockoptsocket_shutdown: 1 0xffffffff96504c70 - kernel!apparmor_socket_shutdownsocket_getpeersec_stream: 1 0xffffffff96506d00 - kernel!apparmor_socket_getpeersec_streamsock_graft: 1 0xffffffff96505200 - kernel!apparmor_sock_graftinet_conn_request: 1 0xffffffff96504b00 - kernel!apparmor_inet_conn_requestaudit_rule_init: 1 0xffffffff964f60a0 - kernel!aa_audit_rule_initaudit_rule_known: 1 0xffffffff964f6150 - kernel!aa_audit_rule_knownaudit_rule_match: 1 0xffffffff964f6190 - kernel!aa_audit_rule_matchaudit_rule_free: 1 0xffffffff964f6040 - kernel!aa_audit_rule_freelocked_down: 1 0xffffffff96516700 - kernel!lockdown_is_locked_downsettime64: 1 0xffffffff964ad940 - kernel!cap_settimevm_enough_memory_mm: 1 0xffffffff964adad0 - kernel!cap_vm_enough_memoryfile_alloc: 1 0xffffffff965076d0 - kernel!apparmor_file_alloc_securityprepare_creds: 1 0xffffffff96505330 - kernel!apparmor_cred_preparesock_rcv_skb: 1 0xffffffff96504b50 - kernel!apparmor_socket_sock_rcv_skb