aya: Set attach mode flag to 0 in bpf_link_create

aya/src/programs/cgroup_device.rs

@@ -5,6 +5,7 @@ use std::os::fd::AsFd;
 use aya_obj::generated::{
     bpf_attach_type::BPF_CGROUP_DEVICE, bpf_prog_type::BPF_PROG_TYPE_CGROUP_DEVICE,
 };
+use log::warn;
 
 use crate::{
     programs::{
@@ -67,6 +68,11 @@ impl CgroupDevice {
     /// Attaches the program to the given cgroup.
     ///
     /// The returned value can be used to detach, see [CgroupDevice::detach]
+    ///
+    /// # Warning
+    ///
+    /// On kernels 5.7.0 and later, attach modes other than CgroupAttachMode::default() are not passed to bpf_link_create.
+    /// On older kernels that use bpf_prog_attach, the attach mode is honored.
     pub fn attach<T: AsFd>(
         &mut self,
         cgroup: T,
@@ -77,11 +83,17 @@ impl CgroupDevice {
         let cgroup_fd = cgroup.as_fd();
 
         if KernelVersion::at_least(5, 7, 0) {
+            if mode != CgroupAttachMode::default() {
+                warn!(
+                    "CgroupAttachMode {:?} will not be passed on to bpf_link_create",
+                    mode
+                );
+            }
             let link_fd = bpf_link_create(
                 prog_fd,
                 LinkTarget::Fd(cgroup_fd),
                 BPF_CGROUP_DEVICE,
-                mode.into(),
+                0,
                 None,
             )
             .map_err(|io_error| SyscallError {

aya/src/programs/cgroup_skb.rs

@@ -6,6 +6,7 @@ use aya_obj::generated::{
     bpf_attach_type::{BPF_CGROUP_INET_EGRESS, BPF_CGROUP_INET_INGRESS},
     bpf_prog_type::BPF_PROG_TYPE_CGROUP_SKB,
 };
+use log::warn;
 
 use crate::{
     VerifierLogLevel,
@@ -86,6 +87,10 @@ impl CgroupSkb {
     /// Attaches the program to the given cgroup.
     ///
     /// The returned value can be used to detach, see [CgroupSkb::detach].
+    ///
+    /// # Warning
+    ///
+    /// On kernels 5.7.0 and later, attach modes other than CgroupAttachMode::default() are not passed to bpf_link_create.
     pub fn attach<T: AsFd>(
         &mut self,
         cgroup: T,
@@ -101,13 +106,13 @@ impl CgroupSkb {
             CgroupSkbAttachType::Egress => BPF_CGROUP_INET_EGRESS,
         };
         if KernelVersion::at_least(5, 7, 0) {
-            let link_fd = bpf_link_create(
+            if mode != CgroupAttachMode::default() {
-                prog_fd,
+                warn!(
-                LinkTarget::Fd(cgroup_fd),
+                    "CgroupAttachMode {:?} will not be passed on to bpf_link_create",
-                attach_type,
+                    mode
-                mode.into(),
+                );
-                None,
+            }
-            )
+            let link_fd = bpf_link_create(prog_fd, LinkTarget::Fd(cgroup_fd), attach_type, 0, None)
                 .map_err(|io_error| SyscallError {
                     call: "bpf_link_create",
                     io_error,

aya/src/programs/cgroup_sock.rs

@@ -4,6 +4,7 @@ use std::{hash::Hash, os::fd::AsFd, path::Path};
 
 use aya_obj::generated::bpf_prog_type::BPF_PROG_TYPE_CGROUP_SOCK;
 pub use aya_obj::programs::CgroupSockAttachType;
+use log::warn;
 
 use crate::{
     VerifierLogLevel,
@@ -70,6 +71,10 @@ impl CgroupSock {
     /// Attaches the program to the given cgroup.
     ///
     /// The returned value can be used to detach, see [CgroupSock::detach].
+    ///
+    /// # Warning
+    ///
+    /// On kernels 5.7.0 and later, attach modes other than CgroupAttachMode::default() are not passed to bpf_link_create. On older kernels that use bpf_prog_attach, the attach mode is still honored.
     pub fn attach<T: AsFd>(
         &mut self,
         cgroup: T,
@@ -80,13 +85,13 @@ impl CgroupSock {
         let cgroup_fd = cgroup.as_fd();
         let attach_type = self.data.expected_attach_type.unwrap();
         if KernelVersion::at_least(5, 7, 0) {
-            let link_fd = bpf_link_create(
+            if mode != CgroupAttachMode::default() {
-                prog_fd,
+                warn!(
-                LinkTarget::Fd(cgroup_fd),
+                    "CgroupAttachMode {:?} will not be passed on to bpf_link_create",
-                attach_type,
+                    mode
-                mode.into(),
+                );
-                None,
+            }
-            )
+            let link_fd = bpf_link_create(prog_fd, LinkTarget::Fd(cgroup_fd), attach_type, 0, None)
                 .map_err(|io_error| SyscallError {
                     call: "bpf_link_create",
                     io_error,

aya/src/programs/cgroup_sock_addr.rs

@@ -4,6 +4,7 @@ use std::{hash::Hash, os::fd::AsFd, path::Path};
 
 use aya_obj::generated::bpf_prog_type::BPF_PROG_TYPE_CGROUP_SOCK_ADDR;
 pub use aya_obj::programs::CgroupSockAddrAttachType;
+use log::warn;
 
 use crate::{
     VerifierLogLevel,
@@ -71,6 +72,11 @@ impl CgroupSockAddr {
     /// Attaches the program to the given cgroup.
     ///
     /// The returned value can be used to detach, see [CgroupSockAddr::detach].
+    ///
+    /// # Warning
+    ///
+    /// On kernels 5.7.0 and later, attach modes other than `CgroupAttachMode::default()` are not passed to `bpf_link_create`.
+    /// On older kernels (using `bpf_prog_attach`), the attach mode is honored.
     pub fn attach<T: AsFd>(
         &mut self,
         cgroup: T,
@@ -81,13 +87,13 @@ impl CgroupSockAddr {
         let cgroup_fd = cgroup.as_fd();
         let attach_type = self.data.expected_attach_type.unwrap();
         if KernelVersion::at_least(5, 7, 0) {
-            let link_fd = bpf_link_create(
+            if mode != CgroupAttachMode::default() {
-                prog_fd,
+                warn!(
-                LinkTarget::Fd(cgroup_fd),
+                    "CgroupAttachMode {:?} will not be passed on to bpf_link_create",
-                attach_type,
+                    mode
-                mode.into(),
+                );
-                None,
+            }
-            )
+            let link_fd = bpf_link_create(prog_fd, LinkTarget::Fd(cgroup_fd), attach_type, 0, None)
                 .map_err(|io_error| SyscallError {
                     call: "bpf_link_create",
                     io_error,

aya/src/programs/cgroup_sockopt.rs

@@ -4,6 +4,7 @@ use std::{hash::Hash, os::fd::AsFd, path::Path};
 
 use aya_obj::generated::bpf_prog_type::BPF_PROG_TYPE_CGROUP_SOCKOPT;
 pub use aya_obj::programs::CgroupSockoptAttachType;
+use log::warn;
 
 use crate::{
     VerifierLogLevel,
@@ -68,6 +69,11 @@ impl CgroupSockopt {
     /// Attaches the program to the given cgroup.
     ///
     /// The returned value can be used to detach, see [CgroupSockopt::detach].
+    ///
+    /// # Warning
+    ///
+    /// On kernels 5.7.0 and later, attach modes other than CgroupAttachMode::default() are not passed to
+    /// `bpf_link_create`. On older kernels, attach modes are honored.
     pub fn attach<T: AsFd>(
         &mut self,
         cgroup: T,
@@ -78,13 +84,13 @@ impl CgroupSockopt {
         let cgroup_fd = cgroup.as_fd();
         let attach_type = self.data.expected_attach_type.unwrap();
         if KernelVersion::at_least(5, 7, 0) {
-            let link_fd = bpf_link_create(
+            if mode != CgroupAttachMode::default() {
-                prog_fd,
+                warn!(
-                LinkTarget::Fd(cgroup_fd),
+                    "CgroupAttachMode {:?} will not be passed on to bpf_link_create",
-                attach_type,
+                    mode
-                mode.into(),
+                );
-                None,
+            }
-            )
+            let link_fd = bpf_link_create(prog_fd, LinkTarget::Fd(cgroup_fd), attach_type, 0, None)
                 .map_err(|io_error| SyscallError {
                     call: "bpf_link_create",
                     io_error,

aya/src/programs/cgroup_sysctl.rs

@@ -5,6 +5,7 @@ use std::{hash::Hash, os::fd::AsFd};
 use aya_obj::generated::{
     bpf_attach_type::BPF_CGROUP_SYSCTL, bpf_prog_type::BPF_PROG_TYPE_CGROUP_SYSCTL,
 };
+use log::warn;
 
 use crate::{
     programs::{
@@ -66,6 +67,10 @@ impl CgroupSysctl {
     /// Attaches the program to the given cgroup.
     ///
     /// The returned value can be used to detach, see [CgroupSysctl::detach].
+    ///
+    /// # Warning
+    ///
+    /// On kernels 5.7.0 and later, attach modes other than CgroupAttachMode::default() are not passed to bpf_link_create.
     pub fn attach<T: AsFd>(
         &mut self,
         cgroup: T,
@@ -76,11 +81,17 @@ impl CgroupSysctl {
         let cgroup_fd = cgroup.as_fd();
 
         if KernelVersion::at_least(5, 7, 0) {
+            if mode != CgroupAttachMode::default() {
+                warn!(
+                    "CgroupAttachMode {:?} will not be passed on to bpf_link_create",
+                    mode
+                );
+            }
             let link_fd = bpf_link_create(
                 prog_fd,
                 LinkTarget::Fd(cgroup_fd),
                 BPF_CGROUP_SYSCTL,
-                mode.into(),
+                0,
                 None,
             )
             .map_err(|io_error| SyscallError {

aya/src/programs/links.rs

@@ -38,7 +38,7 @@ pub trait Link: std::fmt::Debug + Eq + std::hash::Hash + 'static {
 }
 
 /// Program attachment mode.
-#[derive(Clone, Copy, Debug, Default)]
+#[derive(Clone, Copy, Debug, Default, PartialEq)]
 pub enum CgroupAttachMode {
     /// Allows only one BPF program in the cgroup subtree.
     #[default]

aya/src/programs/sock_ops.rs

@@ -4,6 +4,7 @@ use std::os::fd::AsFd;
 use aya_obj::generated::{
     bpf_attach_type::BPF_CGROUP_SOCK_OPS, bpf_prog_type::BPF_PROG_TYPE_SOCK_OPS,
 };
+use log::warn;
 
 use crate::{
     programs::{
@@ -65,6 +66,11 @@ impl SockOps {
     /// Attaches the program to the given cgroup.
     ///
     /// The returned value can be used to detach, see [SockOps::detach].
+    ///
+    /// # Warning
+    ///
+    /// On kernels 5.7.0 and later, attach modes other than `CgroupAttachMode::default()` are not passed to `bpf_link_create`.
+    /// On older kernels (using `bpf_prog_attach`), the attach mode is honored.
     pub fn attach<T: AsFd>(
         &mut self,
         cgroup: T,
@@ -75,13 +81,13 @@ impl SockOps {
         let cgroup_fd = cgroup.as_fd();
         let attach_type = BPF_CGROUP_SOCK_OPS;
         if KernelVersion::at_least(5, 7, 0) {
-            let link_fd = bpf_link_create(
+            if mode != CgroupAttachMode::default() {
-                prog_fd,
+                warn!(
-                LinkTarget::Fd(cgroup_fd),
+                    "CgroupAttachMode {:?} will not be passed on to bpf_link_create",
-                attach_type,
+                    mode
-                mode.into(),
+                );
-                None,
+            }
-            )
+            let link_fd = bpf_link_create(prog_fd, LinkTarget::Fd(cgroup_fd), attach_type, 0, None)
                 .map_err(|io_error| SyscallError {
                     call: "bpf_link_create",
                     io_error,