Document BPF_F_QUERY_EFFECTIVE flag, mostly to clarify how it affects attach_flags what may not be obvious and what may lead to confision. Specifically attach_flags is returned only for target_fd but if programs are inherited from an ancestor cgroup then returned attach_flags for current cgroup may be confusing. For example, two effective programs of same attach_type can be returned but w/o BPF_F_ALLOW_MULTI in attach_flags. Simple repro: # bpftool c s /sys/fs/cgroup/path/to/task ID AttachType AttachFlags Name # bpftool c s /sys/fs/cgroup/path/to/task effective ID AttachType AttachFlags Name 95043 ingress tw_ipt_ingress 95048 ingress tw_ingress
Showing the changes to include/uapi/linux (1 of 2 files). Show all
Unified · Split
| @@ -359,7 +359,12 @@ enum bpf_attach_type { · 358 unmodified lines | |||
| 359 | /* Enable memory-mapping BPF map */ | 359 | /* Enable memory-mapping BPF map */ |
| 360 | #define BPF_F_MMAPABLE (1U << 10) | 360 | #define BPF_F_MMAPABLE (1U << 10) |
| 361 | 361 | ||
| 362 | /* flags for BPF_PROG_QUERY */ | 362 | /* Flags for BPF_PROG_QUERY. */ |
| 363 | |||
| 364 | /* Query effective (directly attached + inherited from ancestor cgroups) | ||
| 365 | * programs that will be executed for events within a cgroup. | ||
| 366 | * attach_flags with this flag are returned only for directly attached programs. | ||
| 367 | */ | ||
| 363 | #define BPF_F_QUERY_EFFECTIVE (1U << 0) | 368 | #define BPF_F_QUERY_EFFECTIVE (1U << 0) |
| 364 | 369 | ||
| 365 | enum bpf_stack_build_id_status { | 370 | enum bpf_stack_build_id_status { |