Libbpf and Linux Kernel Verifier Compatibility for Unprivileged BPF Loading

Minimum Kernel Requirements

To satisfy both the requirement for BPF Type Format (BTF) and the ability to load BPF programs without root privileges (assuming kernel.unprivileged_bpf_disabled = 0), the minimum kernel version is 5.8.

• BTF Availability: Introduced in 5.4 (via CONFIG_DEBUG_INFO_BTF), which is required for CO-RE (Compile Once – Run Everywhere) relocations.
• Unprivileged Loading: While BPF existed earlier, kernel 5.8 established the baseline for unprivileged loading when the corresponding sysctl is disabled.

Verifier Behavior: Kernel 5.9 vs. 5.10

The transition from kernel 5.9 to 5.10 introduced significant tightening of the BPF verifier. While libbpf handles the CO-RE relocations before the program is submitted to the kernel, the resulting bytecode must still pass the verifier's safety checks.

In kernels 5.10 and later, the verifier implements stricter bounds checking and more rigorous pointer arithmetic validation. A CO-RE program compiled with libbpf that successfully loads on 5.9 may be rejected on 5.10 if the relocated offsets or the resulting memory access patterns trigger these new safety constraints. This is not a failure of libbpf's relocation logic, but a change in the kernel's acceptance criteria for the final binary.

Verification Workflow

To determine if a specific libbpf, kernel, and clang combination will support unprivileged CO-RE loading without trial-and-error, follow these verification steps:

1. Confirm BTF Presence: Verify the target kernel was compiled with BTF support by checking for the existence of the vmlinux BTF file:

   ls /sys/kernel/btf/vmlinux

2. Check Unprivileged Permissions: Ensure the kernel allows unprivileged BPF loading:

   sysctl kernel.unprivileged_bpf_disabled

   Note: A value of 0 is required; 1 or 2 will block unprivileged loading regardless of kernel version.
3. Inspect Object Relocations: Use bpftool to ensure the compiled object contains the necessary CO-RE relocation sections:

   bpftool bpf obj dump bpf_program.o

4. Validate Toolchain Alignment: Ensure the clang version used for compilation supports the BPF target and that the headers used for the BPF program match the target kernel's architecture to prevent structural layout mismatches during relocation.

Uncertainty and Distribution Skew

Be aware that many enterprise distributions (e.g., RHEL, Ubuntu LTS) backport verifier fixes and features. A kernel labeled 5.4.x may have verifier behaviors closer to 5.10.x. The only definitive way to confirm compatibility across distributions is to check the specific CONFIG_DEBUG_INFO_BTF status and the active sysctl settings on the target machine.