Re: [PATCH bpf-next] bpf: add BPF_F_SEALED flag to seal BPF links at creation

On Mon Aug 3, 2026 at 4:20 AM CEST, David Windsor wrote:
> On Sun, Aug 2, 2026 at 10:16 PM David Windsor <[email protected]> wrote:
>>
>> Introduce a new BPF_F_SEALED flag for BPF_LINK_CREATE that creates the
>> link permanently sealed. A sealed link can never have its program
>> replaced via BPF_LINK_UPDATE, can never be detached via BPF_LINK_DETACH,
>> and holds an extra self-reference that is never released, so the link and
>> its program attachment persist until the machine reboots, even after user
>> space closes every fd referring to it. There is no way to unseal a link.
>>
>> The sealed state is tracked by a new bool field on struct bpf_link.
>>
>> Signed-off-by: David Windsor <[email protected]>
>> ---
>>  include/linux/bpf.h            |  2 ++
>>  include/uapi/linux/bpf.h       |  1 +
>>  kernel/bpf/syscall.c           | 41 +++++++++++++++++++++++++++++++---
>>  tools/include/uapi/linux/bpf.h |  1 +
>>  4 files changed, 42 insertions(+), 3 deletions(-)
>>
>
> There is deliberately no selftest for this, as running any such
> selftest would necessarily create a sealed link, which cannot be
> cleaned up.

Let's wait for more comments, esp. on whether this is useful or the right path
forward, but I'd still prefer adding selftests to verify various aspects of the
behavior if we proceed.

I think the point about a user being able to create many sealed links is
definitely valid too, so it might make sense to keep this gated behind more
privileged capabilities (if not already).

For tests, we might have to force decrement the link refcount (after verifying
it stays elevated after close(2)) from the test. It might involve some creative
use of a kfunc in bpf_testmod that can do the cleanup for us to avoid wedging
the system on repeated invocations of the test. It wouldn't be available on a
real system. It depends on whether we deem it important enough that leaking the
link on VMs running tests is important enough. You'd probably have to run it
thousands of time to exhaust memory unless the VM is provisioned with a tiny
amount of memory.

Anyway, let's get into all that after seeing how others feel about the concept.