Linux 7.3: BPF Enables Lock-Free Read of Socket Extended Attributes

AFFILIATE_PRODUCTS:

New Helper Function Enabling BPF Read of

Socket Extended Attributes

According to a report by Michael Larabel of Phoronix, a new kernel function called “bpf_sock_read_xattr()” has been integrated into the Linux 7.3 kernel. This function provides a mechanism for BPF programs to read user extended attributes (xattrs) of sockets without locking.

Extended attribute support for sockets was already integrated in the Linux 7.1 kernel. This feature was sought by projects like GNOME and systemd for use with Varlink IPC and other purposes. However, there was previously no efficient way for BPF programs to read these extended attribute labels. This change addresses that limitation.

The patch series, developed by Christian Brauner, makes it possible for BPF programs to read the user.* extended attributes of sockfs inodes in a lock-free manner. systemd utilizes these attributes for implementing socket rate limiting and a Varlink registry.

The Functional Requirements Fulfilled for systemd

Brauner explained the background of the new feature in the patch series:

systemd uses user.* xattrs on sockets to implement socket rate limiting and to tag sockets for other purposes such as implementing a varlink registry. There is currently no efficient way for a BPF program to read those labels back.

systemd sets user.* extended attributes on sockets for purposes like rate limiting and Varlink registry implementation. However, there was no efficient method for BPF programs to read these labels.

The new helper allows listening sockets with extended attributes to be read during bind/connect operations, enabling policy enforcement on connecting sockets. Through the use of extended attributes, unprivileged user managers like systemd —user can tag sockets from user space, later rediscover them, and implement policies.

KF_RCU Registration and sockfs Structural

Guarantees

This kfunc (kernel function) is registered as KF_RCU and is only usable in BPF LSM programs. A struct socket is guaranteed to exist within sockfs only when an LSM socket hook provides it, and the SOCK_INODE() macro remains valid only in this context.

Sockets like tun or tap that embed struct socket outside of sockfs are only reachable from tracing programs and are excluded at registration time. Brauner added that it would be preferable from a consistency perspective to force the allocation of struct socket from sockfs. This is because embedding struct socket in designs like tun_file makes the SOCKFS_I() pattern unsafe when used outside of sockfs functions.

Lock-Free, High-Speed Read Implementation

The read operation does not sleep and does not acquire any locks. In the case of sockfs, values are stored in the in-memory xattr store of the inode, and resolution occurs via a protected RCU Hash Table Lookup through simple_xattr_get(). Neither inode locks nor xattr locks are required.

Therefore, this kfunc can be used from both sleepable/non-sleepable LSM hooks. This establishes a foundation for real-time policy decisions based on extended attributes within the listen/connect processing paths.

Integration into Linux 7.3

This bpf_sock_read_xattr support was integrated via a pull request for the Linux 7.3 kernel. According to information published on August 18, 2026, it has gone through the kernel’s merge process and is slated to be included in the upcoming mainline kernel release.

Related previous reports also covered the latest developments in Linux 7.3, including Linux Cache Aware Scheduling extension achieving up to 360% speedup for MySQL, LingBot Map achieving SOTA in Streaming 3D Reconstruction with Geometric Context Transformer, and Linux 7.3 moves towards stable support for Intel Nova Lake’s integrated GPU.

Editorial Opinion

Short-Term Impact: The ability for systemd to efficiently manage socket rate limiting and the Varlink registry via BPF enhances flexibility in network policy management for container environments and microservice architectures. In the next 3-6 months, development of network control tools utilizing BPF LSM is likely to accelerate.

Long-Term Perspective: The lock-free, non-sleepable read of extended attributes influences state management paradigms within the kernel. Over a 1-3 year span, this could become the foundation for new network security frameworks where BPF programs make complex, real-time policy judgments based on socket metadata.

Editorial Query: How do the constraints on drivers like tinc or tap devices that embed struct socket outside of sockfs limit the applicability scope of BPF LSM? If the proposal to force allocation from sockfs is reflected in the future, what ripple effects could it have on various subsystems?

References

• “Linux 7.3 Adds New “bpf_sock_read_xattr” Feature For systemd, BPF Programs”, by Michael Larabel — Phoronix, 2026-08-18T19:38:32.000Z (ARR)
• Source URL: https://www.phoronix.com/news/Linux-7.3-bpf_sock_read_xattr