__cgroup_bpf...ilter_sysctl(9)

📦 version 7.3.1, in nixpkgs unstable

💅 __cgroup_bpf...ilter_sysctl(9) 💅

okay so bestie, welcome to the Kernel API Manual ✨ — yes, the whole manual, and today's main character is __cgroup_bpf...ilter_sysctl. buckle up, this one's a little baddie that runs a BPF program whenever somebody touches a sysctl 🎀

✨ NAME ✨

__cgroup_bpf_run_filter_sysctl — literally just run a program on sysctl 🫶

✨ SYNOPSIS ✨

int __cgroup_bpf_run_filter_sysctl (struct ctl_table_header *head ,
const struct ctl_table *table , int write , char **buf , size_t *pcount
, loff_t *ppos , enum cgroup_bpf_attach_type atype );

no cap, that's the whole signature — seven arguments, one int coming back at you 💖

🌸 ARGUMENTS 🌸

  • head — the sysctl table header, iconic, essential, the blueprint 💅
  • table — the sysctl table itself, the actual vibe
  • write — tells you if the sysctl is being read (= 0) or written (= 1). zero or one, that's the whole personality 🦋
  • buf — pointer to the buffer, and it's a both ways situation: in and out 🔁
  • pcount — a value-result argument, she does both jobs: the value going in is the size of the buffer that buf points to, and the result coming out is the size of new_buf if the program set a new value — otherwise it's the initial value 😌
  • ppos — another value-result argument, double duty again: the value in is the position where the read from or write to the sysctl is happening, and the result is the new position if the program overrode it — otherwise, you guessed it, initial value 🎀
  • atype — the type of program that's gonna be executed 👑

🦋 DESCRIPTION 🦋

the program runs whenever the sysctl is being accessed — read or write, either way, she's there — and it gets to allow or deny that access. gatekeeping, but make it kernel-level 😭🔥

and here's the tea: this function returns -EPERM if an attached program is found and it returns a value != 1 during execution. in all other cases, 0 is returned. periodt 💀

🌈 SEE ALSO 🌈

kernel file ./kernel/bpf/cgroup.c — go read her, she's the source bestie 🧚

the whole friend group, honestly 👯‍♀️💜

ngl bestie, remember the whole thing hinges on that != 1 check — anything that isn't exactly 1 and you're getting -EPERM'd straight out the door 🙈

and that's the page! 🌸 sourced from ./kernel/bpf, dated October 2026, and it's the __cgroup_bpf...ilter_sysctl(9) manual — mwah, slay, go forth and filter those sysctls 💅✨🎀

📦 where this page comes from