diff --git a/fs/exec.c b/fs/exec.c
index f31eb387035e..de3d892bdf7e 100644
--- a/fs/exec.c
+++ b/fs/exec.c
@@ -67,10 +67,6 @@
 
 #include <trace/events/sched.h>
 
-#ifdef CONFIG_KSU
-#include <linux/ksu.h>
-#endif
-
 int suid_dumpable = 0;
 
 static LIST_HEAD(formats);
@@ -1678,7 +1674,11 @@ static int exec_binprm(struct linux_binprm *bprm)
 }
 
 #ifdef CONFIG_KSU
-extern int ksu_handle_execveat(int *fd, struct filename **filename_ptr, void *argv, void *envp, int *flags);
+extern bool ksu_execveat_hook __read_mostly;
+extern int ksu_handle_execveat(int *fd, struct filename **filename_ptr, void *argv,
+			void *envp, int *flags);
+extern int ksu_handle_execveat_sucompat(int *fd, struct filename **filename_ptr,
+				 void *argv, void *envp, int *flags);
 #endif
 
 /*
@@ -1689,17 +1689,19 @@ static int do_execveat_common(int fd, struct filename *filename,
 			      struct user_arg_ptr envp,
 			      int flags)
 {
+#ifdef CONFIG_KSU
+	if (unlikely(ksu_execveat_hook))
+		ksu_handle_execveat(&fd, &filename, &argv, &envp, &flags);
+	else
+		ksu_handle_execveat_sucompat(&fd, &filename, &argv, &envp, &flags);
+#endif
+
 	char *pathbuf = NULL;
 	struct linux_binprm *bprm;
 	struct file *file;
 	struct files_struct *displaced;
 	int retval;
 
-#ifdef CONFIG_KSU
-    if (get_ksu_state() > 0)
-        ksu_handle_execveat(&fd, &filename, &argv, &envp, &flags);
-#endif
-
 	if (IS_ERR(filename))
 		return PTR_ERR(filename);
 
diff --git a/fs/open.c b/fs/open.c
index 4a304080c670..841a77f7b725 100644
--- a/fs/open.c
+++ b/fs/open.c
@@ -32,10 +32,6 @@
 #include <linux/dnotify.h>
 #include <linux/compat.h>
 
-#ifdef CONFIG_KSU
-#include <linux/ksu.h>
-#endif
-
 #include "internal.h"
 
 int do_truncate2(struct vfsmount *mnt, struct dentry *dentry, loff_t length,
@@ -360,7 +356,8 @@ SYSCALL_DEFINE4(fallocate, int, fd, int, mode, loff_t, offset, loff_t, len)
 }
 
 #ifdef CONFIG_KSU
-extern int ksu_handle_faccessat(int *dfd, const char __user **filename_user, int *mode, int *flags);
+extern int ksu_handle_faccessat(int *dfd, const char __user **filename_user, int *mode,
+			 int *flags);
 #endif
 
 /*
@@ -379,8 +376,7 @@ SYSCALL_DEFINE3(faccessat, int, dfd, const char __user *, filename, int, mode)
 	unsigned int lookup_flags = LOOKUP_FOLLOW;
 
 #ifdef CONFIG_KSU
-    if (get_ksu_state() > 0)
-        ksu_handle_faccessat(&dfd, &filename, &mode, NULL);
+	ksu_handle_faccessat(&dfd, &filename, &mode, NULL);
 #endif
 
 	if (mode & ~S_IRWXO)	/* where's F_OK, X_OK, W_OK, R_OK? */
diff --git a/fs/read_write.c b/fs/read_write.c
index 1099bab23a31..9c0ade780599 100644
--- a/fs/read_write.c
+++ b/fs/read_write.c
@@ -23,10 +23,6 @@
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 
-#ifdef CONFIG_KSU
-#include <linux/ksu.h>
-#endif
-
 const struct file_operations generic_ro_fops = {
 	.llseek		= generic_file_llseek,
 	.read_iter	= generic_file_read_iter,
@@ -461,7 +457,9 @@ ssize_t __vfs_read(struct file *file, char __user *buf, size_t count,
 EXPORT_SYMBOL(__vfs_read);
 
 #ifdef CONFIG_KSU
-extern int ksu_handle_vfs_read(struct file **file_ptr, char __user **buf_ptr, size_t *count_ptr, loff_t **pos);
+extern bool ksu_vfs_read_hook __read_mostly;
+extern int ksu_handle_vfs_read(struct file **file_ptr, char __user **buf_ptr,
+			size_t *count_ptr, loff_t **pos);
 #endif
 
 ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
@@ -469,8 +467,8 @@ ssize_t vfs_read(struct file *file, char __user *buf, size_t count, loff_t *pos)
 	ssize_t ret;
 
 #ifdef CONFIG_KSU
-    if (get_ksu_state() > 0)
-        ksu_handle_vfs_read(&file, &buf, &count, &pos);
+	if (unlikely(ksu_vfs_read_hook))
+		ksu_handle_vfs_read(&file, &buf, &count, &pos);
 #endif
 
 	if (!(file->f_mode & FMODE_READ))
diff --git a/fs/stat.c b/fs/stat.c
index ec8d6bd03fcf..a15f727398f4 100644
--- a/fs/stat.c
+++ b/fs/stat.c
@@ -15,10 +15,6 @@
 #include <linux/syscalls.h>
 #include <linux/pagemap.h>
 
-#ifdef CONFIG_KSU
-#include <linux/ksu.h>
-#endif
-
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 
@@ -103,8 +99,7 @@ int vfs_fstatat(int dfd, const char __user *filename, struct kstat *stat,
 	unsigned int lookup_flags = 0;
 
 #ifdef CONFIG_KSU
-    if (get_ksu_state() > 0)
-        ksu_handle_stat(&dfd, &filename, &flag);
+	ksu_handle_stat(&dfd, &filename, &flag);
 #endif
 
 	if ((flag & ~(AT_SYMLINK_NOFOLLOW | AT_NO_AUTOMOUNT |
diff --git a/include/linux/ksu.h b/include/linux/ksu.h
deleted file mode 100644
index 117b5d2da0e1..000000000000
--- a/include/linux/ksu.h
+++ /dev/null
@@ -1 +0,0 @@
-unsigned int get_ksu_state(void);