From: Leon Hwang <leon.hwang@linux.dev>
To: David Windsor <dwindsor@gmail.com>,
bpf@vger.kernel.org, Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
Jiri Olsa <jolsa@kernel.org>,
John Fastabend <john.fastabend@gmail.com>,
Emil Tsalapatis <emil@etsalapatis.com>,
Ihor Solodrai <ihor.solodrai@linux.dev>
Subject: Re: [PATCH bpf-next] bpf: add BPF_F_SEALED flag to seal BPF links at creation
Date: Mon, 3 Aug 2026 10:44:04 +0800 [thread overview]
Message-ID: <a68933c3-39d6-414e-b869-bb3fd1a6b4ba@linux.dev> (raw)
In-Reply-To: <20260803021643.2189641-1-dwindsor@gmail.com>
On 3/8/26 10:16, David Windsor wrote:
> Introduce a new BPF_F_SEALED flag for BPF_LINK_CREATE that creates the
> link permanently sealed. A sealed link can never have its program
> replaced via BPF_LINK_UPDATE, can never be detached via BPF_LINK_DETACH,
> and holds an extra self-reference that is never released, so the link and
> its program attachment persist until the machine reboots, even after user
> space closes every fd referring to it. There is no way to unseal a link.
>
> The sealed state is tracked by a new bool field on struct bpf_link.
Why do you want BPF_F_SEALED? What's your case for it?
I think 'sealed' should be set before allocating the FD to avoid the
race issues reported by Sashiko.
Thanks,
Leon
> [...]
next prev parent reply other threads:[~2026-08-03 2:44 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-03 2:16 [PATCH bpf-next] bpf: add BPF_F_SEALED flag to seal BPF links at creation David Windsor
2026-08-03 2:20 ` David Windsor
2026-08-03 3:23 ` Kumar Kartikeya Dwivedi
2026-08-03 2:28 ` sashiko-bot
2026-08-03 2:44 ` Leon Hwang [this message]
2026-08-03 3:17 ` Kumar Kartikeya Dwivedi
2026-08-03 3:26 ` David Windsor
2026-08-07 22:30 ` Andrii Nakryiko
2026-08-11 21:23 ` David Windsor
2026-08-03 3:18 ` Kumar Kartikeya Dwivedi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a68933c3-39d6-414e-b869-bb3fd1a6b4ba@linux.dev \
--to=leon.hwang@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=dwindsor@gmail.com \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.