From: Leon Hwang <leon.hwang@linux.dev>
To: David Windsor <dwindsor@gmail.com>,
bpf@vger.kernel.org, Alexei Starovoitov <ast@kernel.org>,
Daniel Borkmann <daniel@iogearbox.net>,
Andrii Nakryiko <andrii@kernel.org>,
Eduard Zingerman <eddyz87@gmail.com>,
Kumar Kartikeya Dwivedi <memxor@gmail.com>
Cc: Martin KaFai Lau <martin.lau@linux.dev>,
Song Liu <song@kernel.org>,
Yonghong Song <yonghong.song@linux.dev>,
Jiri Olsa <jolsa@kernel.org>,
John Fastabend <john.fastabend@gmail.com>,
Emil Tsalapatis <emil@etsalapatis.com>,
Ihor Solodrai <ihor.solodrai@linux.dev>
Subject: Re: [PATCH bpf-next] bpf: add BPF_F_SEALED flag to seal BPF links at creation
Date: Mon, 3 Aug 2026 10:44:04 +0800 [thread overview]
Message-ID: <a68933c3-39d6-414e-b869-bb3fd1a6b4ba@linux.dev> (raw)
In-Reply-To: <20260803021643.2189641-1-dwindsor@gmail.com>
On 3/8/26 10:16, David Windsor wrote:
> Introduce a new BPF_F_SEALED flag for BPF_LINK_CREATE that creates the
> link permanently sealed. A sealed link can never have its program
> replaced via BPF_LINK_UPDATE, can never be detached via BPF_LINK_DETACH,
> and holds an extra self-reference that is never released, so the link and
> its program attachment persist until the machine reboots, even after user
> space closes every fd referring to it. There is no way to unseal a link.
>
> The sealed state is tracked by a new bool field on struct bpf_link.
Why do you want BPF_F_SEALED? What's your case for it?
I think 'sealed' should be set before allocating the FD to avoid the
race issues reported by Sashiko.
Thanks,
Leon
> [...]
next prev parent reply other threads:[~2026-08-03 2:44 UTC|newest]
Thread overview: 10+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-08-03 2:16 [PATCH bpf-next] bpf: add BPF_F_SEALED flag to seal BPF links at creation David Windsor
2026-08-03 2:20 ` David Windsor
2026-08-03 3:23 ` Kumar Kartikeya Dwivedi
2026-08-03 2:28 ` sashiko-bot
2026-08-03 2:44 ` Leon Hwang [this message]
2026-08-03 3:17 ` Kumar Kartikeya Dwivedi
2026-08-03 3:26 ` David Windsor
2026-08-07 22:30 ` Andrii Nakryiko
2026-08-11 21:23 ` David Windsor
2026-08-03 3:18 ` Kumar Kartikeya Dwivedi
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=a68933c3-39d6-414e-b869-bb3fd1a6b4ba@linux.dev \
--to=leon.hwang@linux.dev \
--cc=andrii@kernel.org \
--cc=ast@kernel.org \
--cc=bpf@vger.kernel.org \
--cc=daniel@iogearbox.net \
--cc=dwindsor@gmail.com \
--cc=eddyz87@gmail.com \
--cc=emil@etsalapatis.com \
--cc=ihor.solodrai@linux.dev \
--cc=john.fastabend@gmail.com \
--cc=jolsa@kernel.org \
--cc=martin.lau@linux.dev \
--cc=memxor@gmail.com \
--cc=song@kernel.org \
--cc=yonghong.song@linux.dev \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox