Re: [PATCH] bpf: fix TCX/netkit detach permissions when prog FD isn't given

["Guillaume GONNET" <ggonnet.linux@gmail.com>]

On Mon Jan 26, 2026 at 2:24 PM CET, Daniel Borkmann wrote:
> $subj should be [PATCH bpf] and as the AI review flagged, Fixes tag would
> make sense so that this also gets backported into stable.

> Looks reasonable to me. I looked at the other types as well, and as far as I
> can see for all the others you need to have a valid program fd in order to
> do anything in terms of modifications. Similar to BPF_LINK_{CREATE,UPDATE}
> and BPF_PROG_ATTACH. This assumes you either had a BPF token or CAP_NET_ADMIN
> at the time of the program creation or the correct permissions in BPF fs
> via BPF_OBJ_GET. Anyway, I would change this slightly into the below given
> the above makes assumptions that the detach is always about networking
> programs and it might not be in future.

Ok, I will remake the patch integrating your suggestions. I also did
look at the other program types and maybe there is also an issue with
CGROUP program types, when BPF_F_ALLOW_MULTI flag isn't set. But you need
a CGROUP FD and according to comments, it may be intentional to maintain
backward compatibility. But I'm not sure as the commit af6eea574 with that
CGROUP code is older than the one chaning BPF ACL (c8644cd0e).

Concerning Fixes tag, I will add one but refering to the right commit
that introduced this detach code (e420bed02507), not the one that I
mentioned in my first patch. I will also use the AI commit message, which
is much simpler.