Re: [PATCH bpf-next] bpf: add BPF_F_SEALED flag to seal BPF links at creation

On Fri, Aug 7, 2026 at 6:30 PM Andrii Nakryiko
<[email protected]> wrote:
>
> I had to skim the articles to recall that it was me proposing
> something like this :)
>

I wasn't actually there, but read about it on lwn. Happy to add your
Suggested-By if that makes sense here.

> Anyways, as Kumar mentioned, a) link has to be crated as sealed before
> FD is exposed, it's straightforward, and b) I do think that it would
> be too easy to have syzbots of the world to accidentally or not create
> tons of sealed links, so I'd require CAP_SYS_ADMIN for this, which I
> assume won't be a problem for intended use cases?
>

CAP_SYS_ADMIN makes sense.

> But also, yeah, I wonder what Christian and other BPF LSM users think
> about this.
>

I'll send v2 with the above changes.

The overall intent here is to follow up with another series for map
sealing.  Currently, we're passing BPF_F_SEALED as a flag for
BPF_LINK_CREATE, but I wonder if we should decompose BPF_F_SEALED into
eg BPF_F_LINK_SEALED and BPF_F_MAPS_SEALED?

Link sealing is useful on its own, though, for preserving bpf-lsm
programs around even after all user fd's have been closed.