During daemon-reload we detach and reattach all BPF programs attached to cgroups. This, however, poses a real practical problem for DevicePolicy (and perhaps some other settings using BPF): it presents a period of time where the old device filtering BPF program has been unloaded, but the new one has not been loaded yet. Since the filtering is at open() time, on Facebook servers, we've seen that there's a non-trivial period where applications inside that ostensibly filtered cgroup can grab any device, and often do so, and then retain access to that device even after the reload is over.

I need to double check exactly what process we have for this when doing the daemon-reload, but I suppose we free the BPF programs as part of cleaning out our units. We probably either need to not unload these programs, or load the new ones before tearing down the old ones, but it may be somewhat complicated.