Re: [PATCH bpf-next] bpf: add BPF_F_SEALED flag to seal BPF links at creation

On Sun, Aug 2, 2026 at 10:16 PM David Windsor <[email protected]> wrote:
>
> Introduce a new BPF_F_SEALED flag for BPF_LINK_CREATE that creates the
> link permanently sealed. A sealed link can never have its program
> replaced via BPF_LINK_UPDATE, can never be detached via BPF_LINK_DETACH,
> and holds an extra self-reference that is never released, so the link and
> its program attachment persist until the machine reboots, even after user
> space closes every fd referring to it. There is no way to unseal a link.
>
> The sealed state is tracked by a new bool field on struct bpf_link.
>
> Signed-off-by: David Windsor <[email protected]>
> ---
>  include/linux/bpf.h            |  2 ++
>  include/uapi/linux/bpf.h       |  1 +
>  kernel/bpf/syscall.c           | 41 +++++++++++++++++++++++++++++++---
>  tools/include/uapi/linux/bpf.h |  1 +
>  4 files changed, 42 insertions(+), 3 deletions(-)
>

There is deliberately no selftest for this, as running any such
selftest would necessarily create a sealed link, which cannot be
cleaned up.