Closing the last program fd will detach a link

[lmb]

Describe the bug

Closing the last reference to a program acts like an implicit link detach. See

ebpf-for-windows/tests/end_to_end/end_to_end.cpp

Lines 1547 to 1551 in 13cadc6

	REQUIRE(hook.attach_link(program_fd, nullptr, 0, &link) == EBPF_SUCCESS);
	// Call bpf_object__close() which will close the program fd. That should
	// detach the program from the hook and unload the program.
	bpf_object__close(unique_object.release());

This is the opposite of what happens on Linux: a live link (pinned or otherwise) will keep the program alive until either the last reference is closed or the link is explicitly detached.

According to @saxena-anurag the ownership in the runtime is currently from program to link, while it should probably be the link holding on to a refcount on the program.

OS information

No response

Steps taken to reproduce bug

1. Load a program
2. Attach it via a link
3. Close the program

Expected behavior

The attachment should persist until the link is closed / detached / unpinned.

Actual outcome

The attachment is torn down.

Additional details

No response