On Mon, May 23, 2022 at 4:26 PM Andrii Nakryiko
[off-list ref] wrote:

On Wed, May 18, 2022 at 3:55 PM Stanislav Fomichev [off-list ref] wrote:

quoted

lsm_cgroup/ is the prefix for BPF_LSM_CGROUP.

Signed-off-by: Stanislav Fomichev <redacted>
---
 tools/lib/bpf/libbpf.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/tools/lib/bpf/libbpf.c b/tools/lib/bpf/libbpf.c
index ef7f302e542f..854449dcd072 100644
--- a/tools/lib/bpf/libbpf.c
+++ b/tools/lib/bpf/libbpf.c

@@ -9027,6 +9027,7 @@ static const struct bpf_sec_def section_defs[] = {
        SEC_DEF("fmod_ret.s+",          TRACING, BPF_MODIFY_RETURN, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
        SEC_DEF("fexit.s+",             TRACING, BPF_TRACE_FEXIT, SEC_ATTACH_BTF | SEC_SLEEPABLE, attach_trace),
        SEC_DEF("freplace+",            EXT, 0, SEC_ATTACH_BTF, attach_trace),
+       SEC_DEF("lsm_cgroup+",          LSM, BPF_LSM_CGROUP, SEC_ATTACH_BTF),

we don't do simplistic prefix match anymore, so this doesn't have to
go before lsm+ (we do prefix match only for legacy SEC_SLOPPY cases).
So total nit (but wanted to dispel preconception that we need to avoid
subprefix matches), I'd put this after lsm+

Sure, didn't know the ordering doesn't matter, will do, thanks!