__cgroup_bpf_run_filter_sk(9)

📦 version 7.3.1, in nixpkgs unstable

🌸 __cgroup_bpf_run_filter_sk 🌸

okay bestie, so this one lives in the Kernel API Manual and it's literally the little function that makes a BPF program go brrr on a socket 💅 the name is __cgroup_bpf_run_filter_sk and no, the double underscore isn't a typo, it's just how the kernel do 🫶

✨ NAME ✨

__cgroup_bpf_run_filter_sk — run a program on a sock 🧦 (yes, that's the actual name, don't come for me)

🎀 SYNOPSIS 🎀

int __cgroup_bpf_run_filter_sk (struct sock *sk , enum
       cgroup_bpf_attach_type atype );

💖 ARGUMENTS 💖

  • sk — the sock structure you're gonna manipulate, that's the whole vibe, she's the main character here 👑
  • atype — the type of program that's gonna be executed ✨

🦋 DESCRIPTION 🦋

so the socket you pass in is expected to be of type INET or INET6, periodt. anything else and that's on you, not her 🙈

also, the program type you pass in via type must be suitable for sock filtering — and the function just... trusts you?? no cap, no further check is performed to assert that 💀 so like, read the docs, bestie, fr fr.

here's the tea on return values 🍓:

this function returns -EPERM if any attached program was found and it returned != 1 during execution. in all other cases, 0 is returned. so like, != 1 = blocked, got it? lowkey stressful but okay 😭

💜 SEE ALSO 💜

kernel file ./kernel/bpf/cgroup.c, plus the whole bestie squad:

⭐ alright that's the whole page, you ate that 💅💖 this icon was served to you fresh from ./kernel/bpf, dated October 2026, under the Kernel API Manual banner — go forth and filter some sockets, queen 🌈👑

📦 where this page comes from