Program Types and ELF Sections
The table below lists the program types, their attach types where relevant and the ELF section
names supported by libbpf for them. The ELF section names follow these rules:
type is an exact match, e.g. SEC("socket")
type+ means it can be either exact SEC("type") or well-formed SEC("type/extras")
with a ‘/’ separator between type and extras.
When extras are specified, they provide details of how to auto-attach the BPF program. The
format of extras depends on the program type, e.g. SEC("tracepoint/<category>/<name>")
for tracepoints or SEC("usdt/<path>:<provider>:<name>") for USDT probes. The extras are
described in more detail in the footnotes.
Program Type |
Attach Type |
ELF Section Name |
Sleepable |
BPF_PROG_TYPE_CGROUP_DEVICE
|
BPF_CGROUP_DEVICE
|
cgroup/dev
|
|
BPF_PROG_TYPE_CGROUP_SKB
|
|
cgroup/skb
|
|
BPF_CGROUP_INET_EGRESS
|
cgroup_skb/egress
|
|
BPF_CGROUP_INET_INGRESS
|
cgroup_skb/ingress
|
|
BPF_PROG_TYPE_CGROUP_SOCKOPT
|
BPF_CGROUP_GETSOCKOPT
|
cgroup/getsockopt
|
|
BPF_CGROUP_SETSOCKOPT
|
cgroup/setsockopt
|
|
BPF_PROG_TYPE_CGROUP_SOCK_ADDR
|
BPF_CGROUP_INET4_BIND
|
cgroup/bind4
|
|
BPF_CGROUP_INET4_CONNECT
|
cgroup/connect4
|
|
BPF_CGROUP_INET4_GETPEERNAME
|
cgroup/getpeername4
|
|
BPF_CGROUP_INET4_GETSOCKNAME
|
cgroup/getsockname4
|
|
BPF_CGROUP_INET6_BIND
|
cgroup/bind6
|
|
BPF_CGROUP_INET6_CONNECT
|
cgroup/connect6
|
|
BPF_CGROUP_INET6_GETPEERNAME
|
cgroup/getpeername6
|
|
BPF_CGROUP_INET6_GETSOCKNAME
|
cgroup/getsockname6
|
|
BPF_CGROUP_UDP4_RECVMSG
|
cgroup/recvmsg4
|
|
BPF_CGROUP_UDP4_SENDMSG
|
cgroup/sendmsg4
|
|
BPF_CGROUP_UDP6_RECVMSG
|
cgroup/recvmsg6
|
|
BPF_CGROUP_UDP6_SENDMSG
|
cgroup/sendmsg6
|
|
BPF_CGROUP_UNIX_CONNECT
|
cgroup/connect_unix
|
|
BPF_CGROUP_UNIX_SENDMSG
|
cgroup/sendmsg_unix
|
|
BPF_CGROUP_UNIX_RECVMSG
|
cgroup/recvmsg_unix
|
|
BPF_CGROUP_UNIX_GETPEERNAME
|
cgroup/getpeername_unix
|
|
BPF_CGROUP_UNIX_GETSOCKNAME
|
cgroup/getsockname_unix
|
|
BPF_PROG_TYPE_CGROUP_SOCK
|
BPF_CGROUP_INET4_POST_BIND
|
cgroup/post_bind4
|
|
BPF_CGROUP_INET6_POST_BIND
|
cgroup/post_bind6
|
|
BPF_CGROUP_INET_SOCK_CREATE
|
cgroup/sock_create
|
|
cgroup/sock
|
|
BPF_CGROUP_INET_SOCK_RELEASE
|
cgroup/sock_release
|
|
BPF_PROG_TYPE_CGROUP_SYSCTL
|
BPF_CGROUP_SYSCTL
|
cgroup/sysctl
|
|
BPF_PROG_TYPE_EXT
|
|
freplace+
|
|
BPF_PROG_TYPE_FLOW_DISSECTOR
|
BPF_FLOW_DISSECTOR
|
flow_dissector
|
|
BPF_PROG_TYPE_KPROBE
|
|
kprobe+
|
|
kretprobe+
|
|
ksyscall+
|
|
kretsyscall+
|
|
uprobe+
|
|
uprobe.s+
|
Yes |
uretprobe+
|
|
uretprobe.s+
|
Yes |
usdt+
|
|
BPF_TRACE_KPROBE_MULTI
|
kprobe.multi+
|
|
kretprobe.multi+
|
|
BPF_PROG_TYPE_LIRC_MODE2
|
BPF_LIRC_MODE2
|
lirc_mode2
|
|
BPF_PROG_TYPE_LSM
|
BPF_LSM_CGROUP
|
lsm_cgroup+
|
|
BPF_LSM_MAC
|
lsm+
|
|
lsm.s+
|
Yes |
BPF_PROG_TYPE_LWT_IN
|
|
lwt_in
|
|
BPF_PROG_TYPE_LWT_OUT
|
|
lwt_out
|
|
BPF_PROG_TYPE_LWT_SEG6LOCAL
|
|
lwt_seg6local
|
|
BPF_PROG_TYPE_LWT_XMIT
|
|
lwt_xmit
|
|
BPF_PROG_TYPE_PERF_EVENT
|
|
perf_event
|
|
BPF_PROG_TYPE_RAW_TRACEPOINT_WRITABLE
|
|
raw_tp.w+
|
|
raw_tracepoint.w+
|
|
BPF_PROG_TYPE_RAW_TRACEPOINT
|
|
raw_tp+
|
|
raw_tracepoint+
|
|
BPF_PROG_TYPE_SCHED_ACT
|
|
action
|
|
BPF_PROG_TYPE_SCHED_CLS
|
|
classifier
|
|
tc
|
|
BPF_PROG_TYPE_SK_LOOKUP
|
BPF_SK_LOOKUP
|
sk_lookup
|
|
BPF_PROG_TYPE_SK_MSG
|
BPF_SK_MSG_VERDICT
|
sk_msg
|
|
BPF_PROG_TYPE_SK_REUSEPORT
|
BPF_SK_REUSEPORT_SELECT_OR_MIGRATE
|
sk_reuseport/migrate
|
|
BPF_SK_REUSEPORT_SELECT
|
sk_reuseport
|
|
BPF_PROG_TYPE_SK_SKB
|
|
sk_skb
|
|
BPF_SK_SKB_STREAM_PARSER
|
sk_skb/stream_parser
|
|
BPF_SK_SKB_STREAM_VERDICT
|
sk_skb/stream_verdict
|
|
BPF_PROG_TYPE_SOCKET_FILTER
|
|
socket
|
|
BPF_PROG_TYPE_SOCK_OPS
|
BPF_CGROUP_SOCK_OPS
|
sockops
|
|
BPF_PROG_TYPE_STRUCT_OPS
|
|
struct_ops+
|
|
BPF_PROG_TYPE_SYSCALL
|
|
syscall
|
Yes |
BPF_PROG_TYPE_TRACEPOINT
|
|
tp+
|
|
tracepoint+
|
|
BPF_PROG_TYPE_TRACING
|
BPF_MODIFY_RETURN
|
fmod_ret+
|
|
fmod_ret.s+
|
Yes |
BPF_TRACE_FENTRY
|
fentry+
|
|
fentry.s+
|
Yes |
BPF_TRACE_FEXIT
|
fexit+
|
|
fexit.s+
|
Yes |
BPF_TRACE_ITER
|
iter+
|
|
iter.s+
|
Yes |
BPF_TRACE_RAW_TP
|
tp_btf+
|
|
BPF_PROG_TYPE_XDP
|
BPF_XDP_CPUMAP
|
xdp.frags/cpumap
|
|
xdp/cpumap
|
|
BPF_XDP_DEVMAP
|
xdp.frags/devmap
|
|
xdp/devmap
|
|
BPF_XDP
|
xdp.frags
|
|
xdp
|
|
Footnotes