Re: [PATCH bpf-next 1/4] xdp: Support specifying expected existing program when attaching XDP

Edward Cree
2020-03-30T15:42:01Z

On 29/03/2020 21:23, Andrii Nakryiko wrote:
> But you can't say the same about other XDP applications that do not
> use libxdp. So will your library come with a huge warning
What about a system-wide policy switch to decide whether replacing/
removing an XDP program without EXPECTED_FD is allowed?  That way
the sysadmin gets to choose whether it's the firewall or the packet
analyser that breaks, rather than baking a policy into the design.
Then libxdp just needs to say in the README "you might want to turn
on this switch".  Or maybe it defaults to on, and the other program
has to talk you into turning it off if it wants to be 'ill-behaved'.
Either way, affected users will be driven to the kernel's
documentation for the policy switch, where we can tell them whatever
we think they need to know.

-ed