{"id":"rhel9-unprivileged-bpf-disabled-default","text":"In RHEL 9, unprivileged BPF access is restricted by default (`unprivileged_bpf_disabled = 2`), meaning the `bpf()` syscall is limited to privileged users but an admin can change this.","truth_value":"IN","source":"repo:entries/2026/03/03/en-documentation-red_hat_enterprise_linux-9-html-93_release_notes-available_bpf_.md","source_url":"","source_hash":"","justifications":[],"dependents":[],"metadata":{},"explanation":{"steps":[{"node":"rhel9-unprivileged-bpf-disabled-default","truth_value":"IN","reason":"premise"}]}}