'bpftool' provides a list of loaded bpf programs, but playing around with it just now, it is not obvious to me how to get the actual loaded bpf program details (e.g, pre-JIT version of the loaded program [or even the JIT version]). The man page is pretty terse.

'bpftool prog' / 'bpftool prog list' / 'bpftool prog show' all provided the same output (sample below), and e.g., adding the index in the list, to any of the above commands is an error.

e.g.,

  # bpftool prog
  8: cgroup_device  name sd_devices  tag 1f97e470ec084ee5  gpl
        loaded_at 2022-11-02T08:58:10-0700  uid 0
        xlated 464B  jited 292B  memlock 4096B
  173: cgroup_device  name sd_devices  tag c7286db13d0052fa  gpl
        loaded_at 2022-11-05T23:53:24-0700  uid 0
        xlated 464B  jited 292B  memlock 4096B
  174: cgroup_skb  name sd_fw_egress  tag 6deef7357e7b4530  gpl
        loaded_at 2022-11-05T23:53:24-0700  uid 0
        xlated 64B  jited 58B  memlock 4096B
  .
  .
  .

Does anyone know if it is possible, and how to get the details on the loaded bpf programs?

EDIT:

Loading a bpf program to snoop on mount/umount events, I get:

  189: kprobe  name syscall__mount  tag f618bcdbd5252ac9  gpl
        loaded_at 2022-11-06T10:45:24-0800  uid 0
        xlated 3440B  jited 2478B  memlock 4096B  map_ids 1
        btf_id 200
  190: kprobe  name do_ret_sys_mount  tag 6960d7da9f367709  gpl
        loaded_at 2022-11-06T10:45:24-0800  uid 0
        xlated 600B  jited 442B  memlock 4096B  map_ids 1
        btf_id 200
  191: kprobe  name syscall__umount  tag d332813cc5f79072  gpl
        loaded_at 2022-11-06T10:45:24-0800  uid 0
        xlated 1728B  jited 1223B  memlock 4096B  map_ids 1
        btf_id 200
  192: kprobe  name do_ret_sys_umount  tag a77da47eaebd04a3  gpl
        loaded_at 2022-11-06T10:45:25-0800  uid 0
        xlated 600B  jited 442B  memlock 4096B  map_ids 1
        btf_id 200

So, at least, even without any more details, it is possible to see that something is monitoring mount/unmount. But, still curious about my orginal question.