cgroups: ebpf: also check for ebpf.ErrNotSupported

It is possible for LinkAttachProgram to return ErrNotSupported if
program attachment is not supported at all (which doesn't matter in this
case), but it seems possible that upstream will start returning
ErrNotSupported for BPF_F_REPLACE at some point so it's best to make
sure we don't cause additional regressions here.

Signed-off-by: Aleksa Sarai <[email protected]>

Author: cyphar

libcontainer/cgroups/devices/ebpf_linux.go

@@ -133,11 +133,10 @@ func haveBpfProgReplace() bool {
 			Attach:  ebpf.AttachCGroupDevice,
 			Flags:   unix.BPF_F_ALLOW_MULTI,
 		})
-		if errors.Is(err, unix.EINVAL) {
+		if errors.Is(err, ebpf.ErrNotSupported) || errors.Is(err, unix.EINVAL) {
 			// not supported
 			return
 		}
-		// attach_flags test succeeded.
 		if !errors.Is(err, unix.EBADF) {
 			logrus.Debugf("checking for BPF_F_REPLACE: got unexpected (not EBADF or EINVAL) error: %v", err)
 		}