bpftool-token(8)

💖 bpftool-token — the eBPF token page, bestie edition 💖

okay so real talk, this is bpftool-token from the System Manager's Manual (yes, that manual, the one with all the family drama). It's the part of bpftool(8) that handles eBPF tokens — inspection and simple manipulation, nothing chaotic, we're just looking and nudging. 🎀

---

✨ NAME ✨

bpftool-token — tool for inspection and simple manipulation of eBPF tokens 🦋

---

✨ SYNOPSIS ✨

bpftool [OPTIONS] token COMMAND

OPTIONS := { { -j | --json } [{ -p | --pretty }] | { -d | --debug } }

COMMANDS := { show | list | help }

---

✨ TOKEN COMMANDS ✨

bpftool token { show | list }
bpftool token help

---

✨ DESCRIPTION ✨

bpftool token { show | list }

Lists BPF token information for each bpffs mount point on your system that contains token information. So it's a tour of every mount point that's holding token data. 🌈

The info it gives you includes:

• the mount point path
• the allowed bpf() system call commands
• the maps
• the programs
• the attach types for the token

Everything, diva. Full look. 👑

bpftool prog help

Prints a short help message.

ngl bestie, this page fr fr says prog here and not token — I'm not editing the source, I'm just reading it to you, so I'm leaving it exactly as it's written. 💅

---

✨ OPTIONS ✨

• -h, --help — print a short help message. Similar vibe to bpftool help. 🙈
• -V, --version — prints bpftool's version number (basically like bpftool version), plus the number of the libbpf version in use, plus any optional features that were baked in when bpftool was compiled. Those optional features can include linking against LLVM or libbfd so you get the disassembler for JIT-ted programs (bpftool prog dump jited), and usage of BPF skeletons. Some features — like bpftool prog profile, or showing pids associated to BPF objects — may rely on that skeletons thing. ✨
• -j, --json — generate JSON output. For commands that literally cannot produce JSON, this option has no effect. It just sits there, being decorative. 💀
• -p, --pretty — generate human-readable JSON output. Implies -j. So you don't need to ask twice, it already said yes. 🫶
• -d, --debug — print all the logs available, even debug-level information. That means logs from libbpf and from the verifier, whenever something is attempting to load programs. Bring snacks, it's a lot. 🍓

---

✨ EXAMPLES ✨

Making a token mount point, then checking it out:

# mkdir -p /sys/fs/bpf/token
# mount -t bpf bpffs /sys/fs/bpf/token
  -o delegate_cmds=prog_load:map_create
  -o delegate_progs=kprobe
  -o delegate_attachs=xdp
# bpftool token list

   token_info  /sys/fs/bpf/token
           allowed_cmds:
             map_create          prog_load
           allowed_maps:
           allowed_progs:
             kprobe
           allowed_attachs:
             xdp

look at that output. the formatting? immaculate. the allowed_maps sitting there empty with nothing to say? honestly, relatable. 😭

---

✨ SEE ALSO ✨

bpf(2), bpf-helpers(7), bpftool(8), bpftool-btf(8), bpftool-cgroup(8), bpftool-feature(8), bpftool-gen(8), bpftool-iter(8), bpftool-link(8), bpftool-map(8), bpftool-net(8), bpftool-perf(8), bpftool-prog(8), bpftool-struct_ops(8)

go read the whole friend group, they all ate. 💜

---

and that's the page!! the footer of this little baddie is just bpftool-token(8) — same as the header title, no extra source/version or date text printed down there, so consider this your sign-off. mwah. 💅💖