security_bpf_map_create(9)

📦 version 7.3.1, in nixpkgs unstable

💅 security_bpf_map_create — from the Kernel API Manual, section 9 🎀

okay bestie, welcome to the Kernel API Manual, section 9, and today's main character is security_bpf_map_create. it's a security-hook moment, and honestly it's giving "small function, huge responsibility" ✨

🌸 NAME 🌸

security_bpf_map_create — the vibe check that decides whether you're allowed to make a BPF map at all 💖

✨ SYNOPSIS ✨

int security_bpf_map_create(struct bpf_map *map, union bpf_attr *attr, struct bpf_token *token, bool kernel);

🦋 ARGUMENTS 🦋

  • map — the BPF map object itself, the actual thing being born 🫶
  • attr — the BPF syscall attributes that were used to create the BPF map, aka the receipts for how it got made
  • token — the BPF token that's granting user access 🔑
  • kernel — a bool telling you whether or not the call originated from kernel 👀

🧚 DESCRIPTION 🧚

so what this does is: the kernel does a check whenever it creates a new BPF map. that's the whole vibe check right there 💅

and like — plot twist — this is also the point where the LSM blob gets allocated for the LSMs that need one. so it's not just "allowed or not", it's also "here's your little storage locker, bestie" 🎀

⭐ RETURN ⭐

Returns 0 on success, error on failure. slay when it succeeds, 😭 when it doesn't.

👑 SEE ALSO 👑

this list is long and we are respecting every single one of them, no skipping, periodt. also worth shouting out the kernel file ./security/security.c 🌈

the lsm_* allocators (the blob squad) 🫶

binder + ptrace + caps + quota + misc core 🌸

bprm (exec-era) + fs_context + superblock 🦋

inode + path + dentry girlies 💅

files + mmap + creds + kernel helpers 🍓

task + scheduling + rlimit energy 😤

SysV IPC (msg / shm / sem) 🧚

secctx / procattr / notifications ✨

tun / sctp / mptcp / ib / xfrm 🔥

keys + audit + BPF (our faves) 💖

lockdown + bdev + perf + uring + initramfs ⭐

ngl bestie, that's a lot of cross-references, but every single one of them is here and accounted for. iykyk 🫶

and that's the whole page, no notes 💜 — this came out of ./security, dated October 2026, and it's security_bpf_map_create(9) all the way down. go be iconic with your BPF maps 🌟

📦 where this page comes from