__cgroup_bpf_attach(9)

💅 __cgroup_bpf_attach(9) — from the Kernel API Manual, bestie 🎀

okay so picture this: you're deep in the kernel, you've got a cgroup, you've got a prog, and you need them to be together. That's this function. It attaches the program or the link to a cgroup and propagates that change down to all the descendants, like the gossip girl of the cgroup tree ✨

---

✨ SYNOPSIS ✨

int __cgroup_bpf_attach (struct cgroup *cgrp , struct bpf_prog *prog ,
struct bpf_prog *replace_prog , struct bpf_cgroup_link *link , enum
bpf_attach_type type , u32 flags , u32 id_or_fd , u64 revision );

it's giving eight whole arguments, and yes we're gonna go through every single one 🫶

---

🌸 ARGUMENTS 🌸

• cgrp — the cgroup whose descendants get traversed. like, this is the starting point of the whole propagation moment ✨
• prog — a program to attach 💖
• replace_prog — a previously attached program you wanna replace, but only if BPF_F_REPLACE is set. no flag, no replacing, iykyk.
• link — a link to attach 🦋
• type — the type of attach operation
• flags — option flags
• id_or_fd — relative prog id or fd
• revision — bpf_prog_list revision 👑

---

💀 DESCRIPTION 💀

okay so the actual rules, no cap:

Exactly one of prog or link can be non-null. Exactly one, bestie — not both, not neither, this is not a choose-your-own-adventure 🫠

⚠️ and it must be called with cgroup_mutex held. that's not a suggestion, that's the vibe check you cannot fail 🔥

---

👀 SEE ALSO 👀

• Kernel file ./kernel/bpf/cgroup.c
• cgroup_bpf_release(9)
• cgroup_bpf_release_fn(9)
• cgroup_bpf_inherit(9)
• __cgroup_bpf_replace(9)
• purge_effective_progs(9)
• __cgroup_bpf_detach(9)
• __cgroup_bpf_run_filter_skb(9)
• __cgroup_bpf_run_filter_sk(9)
• __cgroup_bpf_run_filter_sock_addr(9)
• __cgroup_bpf_run_filter_sock_ops(9)
• __cgroup_bpf_run_filter_sysctl(9)

---

aaaand that's the whole page, mwah 🍓 straight from ./kernel/bpf, dated October 2026 — so go forth, hold that cgroup_mutex, and attach responsibly 💜🧚‍♀️