--- title: Linux 7.3 Adds New "bpf_sock_read_xattr" Feature For... description: Linux 7.3 introduces a new bpf_sock_read_xattr() kernel function, developed by Christian Brauner, that lets BPF programs efficiently and locklessly read user.*... canonical: https://daily.dev/posts/linux-7-3-adds-new-bpf-sock-read-xattr-feature-for-systemd-bpf-programs-p0lubk51i twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Linux 7.3 Adds New "bpf_sock_read_xattr" Feature For systemd, BPF Programs | daily.dev og:description: Linux 7.3 introduces a new bpf_sock_read_xattr() kernel function, developed by Christian Brauner, that lets BPF programs efficiently and locklessly read user.*... og:url: https://daily.dev/posts/linux-7-3-adds-new-bpf-sock-read-xattr-feature-for-systemd-bpf-programs-p0lubk51i og:image: https://api.daily.dev/og/posts/P0LUbk51i.png og:image:alt: Linux 7.3 Adds New "bpf_sock_read_xattr" Feature For systemd, BPF Programs og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Linux 7.3 Adds New "bpf_sock_read_xattr" Feature For systemd, BPF Programs **[Phoronix](https://daily.dev/sources/phoronix)** · 2 min read · 0 upvotes · 0 comments ## Summary Linux 7.3 introduces a new bpf_sock_read_xattr() kernel function, developed by Christian Brauner, that lets BPF programs efficiently and locklessly read user.* extended attributes from a socket's sockfs inode. This builds on the extended attributes on sockets feature merged earlier in Linux 7.1, which systemd and GNOME use for socket rate limiting and tagging sockets for purposes like implementing a Varlink registry. The kfunc is registered as KF_RCU and restricted to BPF LSM programs, since struct socket is only guaranteed to live in sockfs when handed out via an LSM socket hook; sockets embedded elsewhere (tun, tap) are excluded. The read never sleeps and takes no locks, resolving values via an RCU-protected rhashtable lookup, making it usable from both sleepable and non-sleepable LSM hooks. The support has been merged for the upcoming Linux 7.3 kernel. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What does the new bpf_sock_read_xattr() function do in Linux 7.3? It lets BPF programs read user.* extended attributes from a socket's sockfs inode without sleeping or taking any lock. Developed by Christian Brauner and merged for Linux 7.3, it resolves values via an RCU-protected rhashtable lookup in simple_xattr_get(), avoiding both the inode lock and any xattr lock, so it works in sleepable and non-sleepable LSM hooks alike. _Track kernel BPF additions like this one on daily.dev as you plan LSM-based socket policies._ ### Why can't bpf_sock_read_xattr be used from tracing programs on tun or tap sockets? The kfunc is registered as KF_RCU and restricted to BPF LSM programs because struct socket is only guaranteed to live in sockfs when an LSM socket hook hands it out, which keeps SOCK_INODE() valid. Sockets embedded outside sockfs, such as those in tun and tap devices, are only reachable from tracing programs and are excluded from this registration. _Developers wiring BPF LSM hooks into socket policies can follow kernel internals like this on daily.dev._ ### How does systemd use extended attributes on sockets? systemd uses user.* xattrs on sockets to implement socket rate limiting and to tag sockets for purposes such as implementing a Varlink registry. This lets an unprivileged user manager like systemd --user mark sockets from userspace and later rediscover them or enforce policies, a capability added as extended attributes on sockets support merged in Linux 7.1. _daily.dev helps systemd and kernel developers keep up with socket xattr features as they land._ ## Similar posts on daily.dev - [Linux 7.1 Looks To Support Extended Attributes On Sockets For New GNOME & systemd Functionality](https://daily.dev/posts/linux-7-1-looks-to-support-extended-attributes-on-sockets-for-new-gnome-systemd-functionality-syzfiqgdw) · Phoronix · 0 upvotes · 0 comments - [user.\* xattrs On Sockets Merged For Linux 7.1 As Sought By GNOME & systemd Developers](https://daily.dev/posts/user-xattrs-on-sockets-merged-for-linux-7-1-as-sought-by-gnome-systemd-developers-ivpo78f8u) · Phoronix · 1 upvotes · 0 comments - [Systemtap 5.6 released](https://daily.dev/posts/systemtap-5-6-released-lh69wzhet) · LWN.net · 0 upvotes · 0 comments - [Linux 7.0 Adds support For BPF Filtering To IO\_uring](https://daily.dev/posts/linux-7-0-adds-support-for-bpf-filtering-to-io-uring-7pxkdezxz) · Phoronix · 0 upvotes · 0 comments - [Cloudflare’s eBPF Replatforming Part 2: Filling Gaps in the Linux Ecosystem with eBPF](https://daily.dev/posts/cloudflare-s-ebpf-replatforming-part-2-filling-gaps-in-the-linux-ecosystem-with-ebpf-f9wl5aqgf) · eBPF · 3 upvotes · 0 comments --- Tags: [#linux](https://daily.dev/tags/linux), [#kernel-development](https://daily.dev/tags/kernel-development) [View this post on daily.dev](https://daily.dev/posts/linux-7-3-adds-new-bpf-sock-read-xattr-feature-for-systemd-bpf-programs-p0lubk51i) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Linux 7.3 Adds New \"bpf_sock_read_xattr\" Feature For systemd, BPF Programs","url":"https://daily.dev/posts/linux-7-3-adds-new-bpf-sock-read-xattr-feature-for-systemd-bpf-programs-p0lubk51i","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/linux-7-3-adds-new-bpf-sock-read-xattr-feature-for-systemd-bpf-programs-p0lubk51i"},"datePublished":"2026-08-18T19:42:41.723Z","dateModified":"2026-08-18T19:43:10.174Z","description":"Linux 7.3 introduces a new bpf_sock_read_xattr() kernel function, developed by Christian Brauner, that lets BPF programs efficiently and locklessly read user.*...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aa9d0a0e113dbf7833bc41b67e6335d6?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/aa9d0a0e113dbf7833bc41b67e6335d6?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Phoronix","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Phoronix","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/6a26ba379dd64932830aa0c9803dd7ee","url":"https://daily.dev/sources/phoronix"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/linux-7-3-adds-new-bpf-sock-read-xattr-feature-for-systemd-bpf-programs-p0lubk51i","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"linux,kernel-development","timeRequired":"PT2M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Phoronix","item":"https://daily.dev/sources/phoronix"},{"@type":"ListItem","position":3,"name":"Linux 7.3 Adds New \"bpf_sock_read_xattr\" Feature For systemd, BPF Programs"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/linux-7-3-adds-new-bpf-sock-read-xattr-feature-for-systemd-bpf-programs-p0lubk51i#faq","mainEntity":[{"@type":"Question","name":"What does the new bpf_sock_read_xattr() function do in Linux 7.3?","acceptedAnswer":{"@type":"Answer","text":"It lets BPF programs read user.* extended attributes from a socket's sockfs inode without sleeping or taking any lock. Developed by Christian Brauner and merged for Linux 7.3, it resolves values via an RCU-protected rhashtable lookup in simple_xattr_get(), avoiding both the inode lock and any xattr lock, so it works in sleepable and non-sleepable LSM hooks alike. Track kernel BPF additions like this one on daily.dev as you plan LSM-based socket policies."}},{"@type":"Question","name":"Why can't bpf_sock_read_xattr be used from tracing programs on tun or tap sockets?","acceptedAnswer":{"@type":"Answer","text":"The kfunc is registered as KF_RCU and restricted to BPF LSM programs because struct socket is only guaranteed to live in sockfs when an LSM socket hook hands it out, which keeps SOCK_INODE() valid. Sockets embedded outside sockfs, such as those in tun and tap devices, are only reachable from tracing programs and are excluded from this registration. Developers wiring BPF LSM hooks into socket policies can follow kernel internals like this on daily.dev."}},{"@type":"Question","name":"How does systemd use extended attributes on sockets?","acceptedAnswer":{"@type":"Answer","text":"systemd uses user.* xattrs on sockets to implement socket rate limiting and to tag sockets for purposes such as implementing a Varlink registry. This lets an unprivileged user manager like systemd --user mark sockets from userspace and later rediscover them or enforce policies, a capability added as extended attributes on sockets support merged in Linux 7.1. daily.dev helps systemd and kernel developers keep up with socket xattr features as they land."}}]} ```