diff --git a/TODO b/TODO
index 90971fbcd0..e69cb70c1c 100644
--- a/TODO
+++ b/TODO
@@ -132,6 +132,11 @@ Deprecations and removals:
 
 Features:
 
+* rewrite bpf-devices in libbpf/C code, rather than home-grown BPF assembly, to
+  match bpf-restrict-fs, bpf-restrict-ifaces, bpf-socket-bind
+
+* ditto: rewrite bpf-firewall in libbpf/C code
+
 * extend the smbios11 logic for passing credentials so that instead of passing
   the credential data literally it can also just reference an AF_VSOCK CID/port
   to read them from. This way the data doesn't remain in the SMBIOS blob during
diff --git a/src/core/bpf-lsm.h b/src/core/bpf-lsm.h
deleted file mode 100644
index a6eda193fe..0000000000
--- a/src/core/bpf-lsm.h
+++ /dev/null
@@ -1,28 +0,0 @@
-/* SPDX-License-Identifier: LGPL-2.1-or-later */
-#pragma once
-
-#include "hashmap.h"
-
-typedef enum FilesystemParseFlags {
-        FILESYSTEM_PARSE_INVERT     = 1 << 0,
-        FILESYSTEM_PARSE_ALLOW_LIST = 1 << 1,
-        FILESYSTEM_PARSE_LOG        = 1 << 2,
-} FilesystemParseFlags;
-
-typedef struct Unit Unit;
-typedef struct Manager Manager;
-
-typedef struct restrict_fs_bpf restrict_fs_bpf;
-
-bool lsm_bpf_supported(bool initialize);
-int lsm_bpf_setup(Manager *m);
-int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list);
-int lsm_bpf_cleanup(const Unit *u);
-int lsm_bpf_map_restrict_fs_fd(Unit *u);
-void lsm_bpf_destroy(struct restrict_fs_bpf *prog);
-int lsm_bpf_parse_filesystem(const char *name,
-                             Set **filesystems,
-                             FilesystemParseFlags flags,
-                             const char *unit,
-                             const char *filename,
-                             unsigned line);
diff --git a/src/core/bpf-lsm.c b/src/core/bpf-restrict-fs.c
similarity index 74%
rename from src/core/bpf-lsm.c
rename to src/core/bpf-restrict-fs.c
index 216fc341c1..15ef86d50f 100644
--- a/src/core/bpf-lsm.c
+++ b/src/core/bpf-restrict-fs.c
@@ -10,7 +10,7 @@
 #include <unistd.h>
 
 #include "alloc-util.h"
-#include "bpf-lsm.h"
+#include "bpf-restrict-fs.h"
 #include "cgroup-util.h"
 #include "fd-util.h"
 #include "fileio.h"
@@ -63,36 +63,36 @@ static int prepare_restrict_fs_bpf(struct restrict_fs_bpf **ret_obj) {
 
         obj = restrict_fs_bpf__open();
         if (!obj)
-                return log_error_errno(errno, "bpf-lsm: Failed to open BPF object: %m");
+                return log_error_errno(errno, "bpf-restrict-fs: Failed to open BPF object: %m");
 
         /* TODO Maybe choose a number based on runtime information? */
         r = sym_bpf_map__set_max_entries(obj->maps.cgroup_hash, CGROUP_HASH_SIZE_MAX);
         assert(r <= 0);
         if (r < 0)
-                return log_error_errno(r, "bpf-lsm: Failed to resize BPF map '%s': %m",
+                return log_error_errno(r, "bpf-restrict-fs: Failed to resize BPF map '%s': %m",
                                        sym_bpf_map__name(obj->maps.cgroup_hash));
 
         /* Dummy map to satisfy the verifier */
         inner_map_fd = compat_bpf_map_create(BPF_MAP_TYPE_HASH, NULL, sizeof(uint32_t), sizeof(uint32_t), 128U, NULL);
         if (inner_map_fd < 0)
-                return log_error_errno(errno, "bpf-lsm: Failed to create BPF map: %m");
+                return log_error_errno(errno, "bpf-restrict-fs: Failed to create BPF map: %m");
 
         r = sym_bpf_map__set_inner_map_fd(obj->maps.cgroup_hash, inner_map_fd);
         assert(r <= 0);
         if (r < 0)
-                return log_error_errno(r, "bpf-lsm: Failed to set inner map fd: %m");
+                return log_error_errno(r, "bpf-restrict-fs: Failed to set inner map fd: %m");
 
         r = restrict_fs_bpf__load(obj);
         assert(r <= 0);
         if (r < 0)
-                return log_error_errno(r, "bpf-lsm: Failed to load BPF object: %m");
+                return log_error_errno(r, "bpf-restrict-fs: Failed to load BPF object: %m");
 
         *ret_obj = TAKE_PTR(obj);
 
         return 0;
 }
 
-bool lsm_bpf_supported(bool initialize) {
+bool bpf_restrict_fs_supported(bool initialize) {
         _cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = NULL;
         static int supported = -1;
         int r;
@@ -107,12 +107,12 @@ bool lsm_bpf_supported(bool initialize) {
 
         r = lsm_supported("bpf");
         if (r < 0) {
-                log_warning_errno(r, "bpf-lsm: Can't determine whether the BPF LSM module is used: %m");
+                log_warning_errno(r, "bpf-restrict-fs: Can't determine whether the BPF LSM module is used: %m");
                 return (supported = false);
         }
         if (r == 0) {
                 log_info_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
-                               "bpf-lsm: BPF LSM hook not enabled in the kernel, BPF LSM not supported");
+                               "bpf-restrict-fs: BPF LSM hook not enabled in the kernel, BPF LSM not supported");
                 return (supported = false);
         }
 
@@ -122,14 +122,14 @@ bool lsm_bpf_supported(bool initialize) {
 
         if (!bpf_can_link_lsm_program(obj->progs.restrict_filesystems)) {
                 log_warning_errno(SYNTHETIC_ERRNO(EOPNOTSUPP),
-                                  "bpf-lsm: Failed to link program; assuming BPF LSM is not available");
+                                  "bpf-restrict-fs: Failed to link program; assuming BPF LSM is not available");
                 return (supported = false);
         }
 
         return (supported = true);
 }
 
-int lsm_bpf_setup(Manager *m) {
+int bpf_restrict_fs_setup(Manager *m) {
         _cleanup_(restrict_fs_bpf_freep) struct restrict_fs_bpf *obj = NULL;
         _cleanup_(bpf_link_freep) struct bpf_link *link = NULL;
         int r;
@@ -143,10 +143,10 @@ int lsm_bpf_setup(Manager *m) {
         link = sym_bpf_program__attach_lsm(obj->progs.restrict_filesystems);
         r = sym_libbpf_get_error(link);
         if (r != 0)
-                return log_error_errno(r, "bpf-lsm: Failed to link '%s' LSM BPF program: %m",
+                return log_error_errno(r, "bpf-restrict-fs: Failed to link '%s' LSM BPF program: %m",
                                        sym_bpf_program__name(obj->progs.restrict_filesystems));
 
-        log_info("bpf-lsm: LSM BPF program attached");
+        log_info("bpf-restrict-fs: LSM BPF program attached");
 
         obj->links.restrict_filesystems = TAKE_PTR(link);
         m->restrict_fs = TAKE_PTR(obj);
@@ -154,7 +154,7 @@ int lsm_bpf_setup(Manager *m) {
         return 0;
 }
 
-int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list) {
+int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list) {
         uint32_t dummy_value = 1, zero = 0;
         const char *fs;
         const statfs_f_type_t *magic;
@@ -171,35 +171,35 @@ int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int
                         128U, /* Should be enough for all filesystem types */
                         NULL);
         if (inner_map_fd < 0)
-                return log_error_errno(errno, "bpf-lsm: Failed to create inner BPF map: %m");
+                return log_error_errno(errno, "bpf-restrict-fs: Failed to create inner BPF map: %m");
 
         if (sym_bpf_map_update_elem(outer_map_fd, &cgroup_id, &inner_map_fd, BPF_ANY) != 0)
-                return log_error_errno(errno, "bpf-lsm: Error populating BPF map: %m");
+                return log_error_errno(errno, "bpf-restrict-fs: Error populating BPF map: %m");
 
         uint32_t allow = allow_list;
 
         /* Use key 0 to store whether this is an allow list or a deny list */
         if (sym_bpf_map_update_elem(inner_map_fd, &zero, &allow, BPF_ANY) != 0)
-                return log_error_errno(errno, "bpf-lsm: Error initializing map: %m");
+                return log_error_errno(errno, "bpf-restrict-fs: Error initializing map: %m");
 
         SET_FOREACH(fs, filesystems) {
                 r = fs_type_from_string(fs, &magic);
                 if (r < 0) {
-                        log_warning("bpf-lsm: Invalid filesystem name '%s', ignoring.", fs);
+                        log_warning("bpf-restrict-fs: Invalid filesystem name '%s', ignoring.", fs);
                         continue;
                 }
 
-                log_debug("bpf-lsm: Restricting filesystem access to '%s'", fs);
+                log_debug("bpf-restrict-fs: Restricting filesystem access to '%s'", fs);
 
                 for (int i = 0; i < FILESYSTEM_MAGIC_MAX; i++) {
                         if (magic[i] == 0)
                                 break;
 
                         if (sym_bpf_map_update_elem(inner_map_fd, &magic[i], &dummy_value, BPF_ANY) != 0) {
-                                r = log_error_errno(errno, "bpf-lsm: Failed to update BPF map: %m");
+                                r = log_error_errno(errno, "bpf-restrict-fs: Failed to update BPF map: %m");
 
                                 if (sym_bpf_map_delete_elem(outer_map_fd, &cgroup_id) != 0)
-                                        log_debug_errno(errno, "bpf-lsm: Failed to delete cgroup entry from BPF map: %m");
+                                        log_debug_errno(errno, "bpf-restrict-fs: Failed to delete cgroup entry from BPF map: %m");
 
                                 return r;
                         }
@@ -209,12 +209,12 @@ int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int
         return 0;
 }
 
-int lsm_bpf_cleanup(const Unit *u) {
+int bpf_restrict_fs_cleanup(const Unit *u) {
         assert(u);
         assert(u->manager);
 
         /* If we never successfully detected support, there is nothing to clean up. */
-        if (!lsm_bpf_supported(/* initialize = */ false))
+        if (!bpf_restrict_fs_supported(/* initialize = */ false))
                 return 0;
 
         if (!u->manager->restrict_fs)
@@ -225,15 +225,15 @@ int lsm_bpf_cleanup(const Unit *u) {
 
         int fd = sym_bpf_map__fd(u->manager->restrict_fs->maps.cgroup_hash);
         if (fd < 0)
-                return log_unit_error_errno(u, errno, "bpf-lsm: Failed to get BPF map fd: %m");
+                return log_unit_error_errno(u, errno, "bpf-restrict-fs: Failed to get BPF map fd: %m");
 
         if (sym_bpf_map_delete_elem(fd, &u->cgroup_id) != 0 && errno != ENOENT)
-                return log_unit_debug_errno(u, errno, "bpf-lsm: Failed to delete cgroup entry from LSM BPF map: %m");
+                return log_unit_debug_errno(u, errno, "bpf-restrict-fs: Failed to delete cgroup entry from LSM BPF map: %m");
 
         return 0;
 }
 
-int lsm_bpf_map_restrict_fs_fd(Unit *unit) {
+int bpf_restrict_fs_map_fd(Unit *unit) {
         assert(unit);
         assert(unit->manager);
 
@@ -243,36 +243,36 @@ int lsm_bpf_map_restrict_fs_fd(Unit *unit) {
         return sym_bpf_map__fd(unit->manager->restrict_fs->maps.cgroup_hash);
 }
 
-void lsm_bpf_destroy(struct restrict_fs_bpf *prog) {
+void bpf_restrict_fs_destroy(struct restrict_fs_bpf *prog) {
         restrict_fs_bpf__destroy(prog);
 }
 #else /* ! BPF_FRAMEWORK */
-bool lsm_bpf_supported(bool initialize) {
+bool bpf_restrict_fs_supported(bool initialize) {
         return false;
 }
 
-int lsm_bpf_setup(Manager *m) {
-        return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm: Failed to set up LSM BPF: %m");
+int bpf_restrict_fs_setup(Manager *m) {
+        return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-restrict-fs: Failed to set up LSM BPF: %m");
 }
 
-int lsm_bpf_restrict_filesystems(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, const bool allow_list) {
-        return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-lsm: Failed to restrict filesystems using LSM BPF: %m");
+int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, const bool allow_list) {
+        return log_debug_errno(SYNTHETIC_ERRNO(EOPNOTSUPP), "bpf-restrict-fs: Failed to restrict filesystems using LSM BPF: %m");
 }
 
-int lsm_bpf_cleanup(const Unit *u) {
+int bpf_restrict_fs_cleanup(const Unit *u) {
         return 0;
 }
 
-int lsm_bpf_map_restrict_fs_fd(Unit *unit) {
+int bpf_restrict_fs_map_fd(Unit *unit) {
         return -ENOMEDIUM;
 }
 
-void lsm_bpf_destroy(struct restrict_fs_bpf *prog) {
+void bpf_restrict_fs_destroy(struct restrict_fs_bpf *prog) {
         return;
 }
 #endif
 
-int lsm_bpf_parse_filesystem(
+int bpf_restrict_fs_parse_filesystem(
                 const char *name,
                 Set **filesystems,
                 FilesystemParseFlags flags,
@@ -290,7 +290,7 @@ int lsm_bpf_parse_filesystem(
                 set = filesystem_set_find(name);
                 if (!set) {
                         log_syntax(unit, flags & FILESYSTEM_PARSE_LOG ? LOG_WARNING : LOG_DEBUG, filename, line, 0,
-                                   "bpf-lsm: Unknown filesystem group, ignoring: %s", name);
+                                   "bpf-restrict-fs: Unknown filesystem group, ignoring: %s", name);
                         return 0;
                 }
 
@@ -299,7 +299,7 @@ int lsm_bpf_parse_filesystem(
                          * (i.e. take away the FILESYSTEM_PARSE_LOG flag) since any issues in the group table
                          * are our own problem, not a problem in user configuration data and we shouldn't
                          * pretend otherwise by complaining about them. */
-                        r = lsm_bpf_parse_filesystem(i, filesystems, flags &~ FILESYSTEM_PARSE_LOG, unit, filename, line);
+                        r = bpf_restrict_fs_parse_filesystem(i, filesystems, flags &~ FILESYSTEM_PARSE_LOG, unit, filename, line);
                         if (r < 0)
                                 return r;
                 }
diff --git a/src/core/bpf-restrict-fs.h b/src/core/bpf-restrict-fs.h
new file mode 100644
index 0000000000..ffb360b117
--- /dev/null
+++ b/src/core/bpf-restrict-fs.h
@@ -0,0 +1,23 @@
+/* SPDX-License-Identifier: LGPL-2.1-or-later */
+#pragma once
+
+#include "hashmap.h"
+
+typedef enum FilesystemParseFlags {
+        FILESYSTEM_PARSE_INVERT     = 1 << 0,
+        FILESYSTEM_PARSE_ALLOW_LIST = 1 << 1,
+        FILESYSTEM_PARSE_LOG        = 1 << 2,
+} FilesystemParseFlags;
+
+typedef struct Unit Unit;
+typedef struct Manager Manager;
+
+typedef struct restrict_fs_bpf restrict_fs_bpf;
+
+bool bpf_restrict_fs_supported(bool initialize);
+int bpf_restrict_fs_setup(Manager *m);
+int bpf_restrict_fs_update(const Set *filesystems, uint64_t cgroup_id, int outer_map_fd, bool allow_list);
+int bpf_restrict_fs_cleanup(const Unit *u);
+int bpf_restrict_fs_map_fd(Unit *u);
+void bpf_restrict_fs_destroy(struct restrict_fs_bpf *prog);
+int bpf_restrict_fs_parse_filesystem(const char *name, Set **filesystems, FilesystemParseFlags flags, const char *unit, const char *filename, unsigned line);
diff --git a/src/core/restrict-ifaces.c b/src/core/bpf-restrict-ifaces.c
similarity index 91%
rename from src/core/restrict-ifaces.c
rename to src/core/bpf-restrict-ifaces.c
index 4dd8656718..9cfe49a318 100644
--- a/src/core/restrict-ifaces.c
+++ b/src/core/bpf-restrict-ifaces.c
@@ -1,7 +1,7 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
 #include "fd-util.h"
-#include "restrict-ifaces.h"
+#include "bpf-restrict-ifaces.h"
 #include "netlink-util.h"
 
 #if BPF_FRAMEWORK
@@ -72,7 +72,7 @@ static int prepare_restrict_ifaces_bpf(
         return 0;
 }
 
-int restrict_network_interfaces_supported(void) {
+int bpf_restrict_ifaces_supported(void) {
         _cleanup_(restrict_ifaces_bpf_freep) struct restrict_ifaces_bpf *obj = NULL;
         static int supported = -1;
         int r;
@@ -97,7 +97,7 @@ int restrict_network_interfaces_supported(void) {
         return (supported = bpf_can_link_program(obj->progs.sd_restrictif_i));
 }
 
-static int restrict_network_interfaces_install_impl(Unit *u) {
+static int restrict_ifaces_install_impl(Unit *u) {
         _cleanup_(bpf_link_freep) struct bpf_link *egress_link = NULL, *ingress_link = NULL;
         _cleanup_(restrict_ifaces_bpf_freep) struct restrict_ifaces_bpf *obj = NULL;
         _cleanup_free_ char *cgroup_path = NULL;
@@ -143,13 +143,15 @@ static int restrict_network_interfaces_install_impl(Unit *u) {
         return 0;
 }
 
-int restrict_network_interfaces_install(Unit *u) {
-        int r = restrict_network_interfaces_install_impl(u);
+int bpf_restrict_ifaces_install(Unit *u) {
+        int r;
+
+        r = restrict_ifaces_install_impl(u);
         fdset_close(u->initial_restric_ifaces_link_fds);
         return r;
 }
 
-int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds) {
+int bpf_restrict_ifaces_serialize(Unit *u, FILE *f, FDSet *fds) {
         int r;
 
         assert(u);
@@ -161,7 +163,7 @@ int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds) {
         return bpf_serialize_link(f, fds, "restrict-ifaces-bpf-fd", u->restrict_ifaces_egress_bpf_link);
 }
 
-int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd) {
+int bpf_restrict_ifaces_add_initial_link_fd(Unit *u, int fd) {
         int r;
 
         assert(u);
@@ -181,20 +183,20 @@ int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd) {
 }
 
 #else /* ! BPF_FRAMEWORK */
-int restrict_network_interfaces_supported(void) {
+int bpf_restrict_ifaces_supported(void) {
         return 0;
 }
 
-int restrict_network_interfaces_install(Unit *u) {
+int bpf_restrict_ifaces_install(Unit *u) {
         return log_unit_debug_errno(u, SYNTHETIC_ERRNO(EOPNOTSUPP),
                         "restrict-interfaces: Failed to install; BPF programs built from source code are not supported: %m");
 }
 
-int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds) {
+int bpf_restrict_ifaces_serialize(Unit *u, FILE *f, FDSet *fds) {
         return 0;
 }
 
-int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd) {
+int bpf_restrict_ifaces_add_initial_link_fd(Unit *u, int fd) {
         return 0;
 }
 #endif
diff --git a/src/core/restrict-ifaces.h b/src/core/bpf-restrict-ifaces.h
similarity index 52%
rename from src/core/restrict-ifaces.h
rename to src/core/bpf-restrict-ifaces.h
index 6e7a824364..28f74279f5 100644
--- a/src/core/restrict-ifaces.h
+++ b/src/core/bpf-restrict-ifaces.h
@@ -6,11 +6,11 @@
 
 typedef struct Unit Unit;
 
-int restrict_network_interfaces_supported(void);
-int restrict_network_interfaces_install(Unit *u);
+int bpf_restrict_ifaces_supported(void);
+int bpf_restrict_ifaces_install(Unit *u);
 
-int serialize_restrict_network_interfaces(Unit *u, FILE *f, FDSet *fds);
+int bpf_restrict_ifaces_serialize(Unit *u, FILE *f, FDSet *fds);
 
 /* Add BPF link fd created before daemon-reload or daemon-reexec.
  * FDs will be closed at the end of restrict_network_interfaces_install. */
-int restrict_network_interfaces_add_initial_link_fd(Unit *u, int fd);
+int bpf_restrict_ifaces_add_initial_link_fd(Unit *u, int fd);
diff --git a/src/core/bpf-socket-bind.c b/src/core/bpf-socket-bind.c
index 9f290ab412..b1b1a6770e 100644
--- a/src/core/bpf-socket-bind.c
+++ b/src/core/bpf-socket-bind.c
@@ -212,7 +212,7 @@ int bpf_socket_bind_install(Unit *u) {
         return r;
 }
 
-int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds) {
+int bpf_socket_bind_serialize(Unit *u, FILE *f, FDSet *fds) {
         int r;
 
         assert(u);
@@ -238,7 +238,7 @@ int bpf_socket_bind_install(Unit *u) {
                                     "bpf-socket-bind: Failed to install; BPF framework is not supported");
 }
 
-int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds) {
+int bpf_socket_bind_serialize(Unit *u, FILE *f, FDSet *fds) {
         return 0;
 }
 #endif
diff --git a/src/core/bpf-socket-bind.h b/src/core/bpf-socket-bind.h
index 7d426df714..28b25f6872 100644
--- a/src/core/bpf-socket-bind.h
+++ b/src/core/bpf-socket-bind.h
@@ -12,4 +12,4 @@ int bpf_socket_bind_add_initial_link_fd(Unit *u, int fd);
 
 int bpf_socket_bind_install(Unit *u);
 
-int bpf_serialize_socket_bind(Unit *u, FILE *f, FDSet *fds);
+int bpf_socket_bind_serialize(Unit *u, FILE *f, FDSet *fds);
diff --git a/src/core/cgroup.c b/src/core/cgroup.c
index 6c37856faf..bc820b7d14 100644
--- a/src/core/cgroup.c
+++ b/src/core/cgroup.c
@@ -10,6 +10,7 @@
 #include "bpf-devices.h"
 #include "bpf-firewall.h"
 #include "bpf-foreign.h"
+#include "bpf-restrict-ifaces.h"
 #include "bpf-socket-bind.h"
 #include "btrfs-util.h"
 #include "bus-error.h"
@@ -32,7 +33,6 @@
 #include "percent-util.h"
 #include "process-util.h"
 #include "procfs-util.h"
-#include "restrict-ifaces.h"
 #include "set.h"
 #include "special.h"
 #include "stdio-util.h"
@@ -1849,7 +1849,7 @@ static void cgroup_apply_socket_bind(Unit *u) {
 static void cgroup_apply_restrict_network_interfaces(Unit *u) {
         assert(u);
 
-        (void) restrict_network_interfaces_install(u);
+        (void) bpf_restrict_ifaces_install(u);
 }
 
 static int cgroup_apply_devices(Unit *u) {
@@ -3451,7 +3451,7 @@ void unit_prune_cgroup(Unit *u) {
                 (void) unit_get_memory_accounting(u, metric, /* ret = */ NULL);
 
 #if BPF_FRAMEWORK
-        (void) lsm_bpf_cleanup(u); /* Remove cgroup from the global LSM BPF map */
+        (void) bpf_restrict_fs_cleanup(u); /* Remove cgroup from the global LSM BPF map */
 #endif
 
         unit_modify_nft_set(u, /* add = */ false);
@@ -3987,7 +3987,7 @@ static int cg_bpf_mask_supported(CGroupMask *ret) {
                 mask |= CGROUP_MASK_BPF_SOCKET_BIND;
 
         /* BPF-based cgroup_skb/{egress|ingress} hooks */
-        r = restrict_network_interfaces_supported();
+        r = bpf_restrict_ifaces_supported();
         if (r < 0)
                 return r;
         if (r > 0)
diff --git a/src/core/cgroup.h b/src/core/cgroup.h
index 6cb04f4eb2..d834cb8bbd 100644
--- a/src/core/cgroup.h
+++ b/src/core/cgroup.h
@@ -3,7 +3,7 @@
 
 #include <stdbool.h>
 
-#include "bpf-lsm.h"
+#include "bpf-restrict-fs.h"
 #include "cgroup-util.h"
 #include "cpu-set-util.h"
 #include "firewall-util.h"
diff --git a/src/core/dbus-execute.c b/src/core/dbus-execute.c
index 602fec1314..cad6a200b5 100644
--- a/src/core/dbus-execute.c
+++ b/src/core/dbus-execute.c
@@ -1898,7 +1898,7 @@ int bus_exec_context_set_transient_property(
                                 c->restrict_filesystems_allow_list = allow_list;
 
                         STRV_FOREACH(s, l) {
-                                r = lsm_bpf_parse_filesystem(
+                                r = bpf_restrict_fs_parse_filesystem(
                                               *s,
                                               &c->restrict_filesystems,
                                               FILESYSTEM_PARSE_LOG|
diff --git a/src/core/exec-invoke.c b/src/core/exec-invoke.c
index 829e094f51..ab13f0342a 100644
--- a/src/core/exec-invoke.c
+++ b/src/core/exec-invoke.c
@@ -22,7 +22,7 @@
 #include "argv-util.h"
 #include "barrier.h"
 #include "bpf-dlopen.h"
-#include "bpf-lsm.h"
+#include "bpf-restrict-fs.h"
 #include "btrfs-util.h"
 #include "capability-util.h"
 #include "cgroup-setup.h"
@@ -1704,7 +1704,7 @@ static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters
         if (!exec_context_restrict_filesystems_set(c))
                 return 0;
 
-        if (p->bpf_outer_map_fd < 0) {
+        if (p->bpf_restrict_fs_map_fd < 0) {
                 /* LSM BPF is unsupported or lsm_bpf_setup failed */
                 log_exec_debug(c, p, "LSM BPF not supported, skipping RestrictFileSystems=");
                 return 0;
@@ -1715,7 +1715,7 @@ static int apply_restrict_filesystems(const ExecContext *c, const ExecParameters
         if (r < 0)
                 return r;
 
-        return lsm_bpf_restrict_filesystems(c->restrict_filesystems, p->cgroup_id, p->bpf_outer_map_fd, c->restrict_filesystems_allow_list);
+        return bpf_restrict_fs_update(c->restrict_filesystems, p->cgroup_id, p->bpf_restrict_fs_map_fd, c->restrict_filesystems_allow_list);
 }
 #endif
 
@@ -4139,7 +4139,7 @@ int exec_invoke(
         }
 
 #if HAVE_LIBBPF
-        r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, &params->bpf_outer_map_fd);
+        r = add_shifted_fd(keep_fds, ELEMENTSOF(keep_fds), &n_keep_fds, &params->bpf_restrict_fs_map_fd);
         if (r < 0) {
                 *exit_status = EXIT_FDS;
                 return log_exec_error_errno(context, params, r, "Failed to collect shifted fd: %m");
diff --git a/src/core/execute-serialize.c b/src/core/execute-serialize.c
index ccfc00c6e9..c7cda98ff0 100644
--- a/src/core/execute-serialize.c
+++ b/src/core/execute-serialize.c
@@ -1365,7 +1365,7 @@ static int exec_parameters_serialize(const ExecParameters *p, const ExecContext
                 return r;
 
         if (c && exec_context_restrict_filesystems_set(c)) {
-                r = serialize_fd(f, fds, "exec-parameters-bpf-outer-map-fd", p->bpf_outer_map_fd);
+                r = serialize_fd(f, fds, "exec-parameters-bpf-outer-map-fd", p->bpf_restrict_fs_map_fd);
                 if (r < 0)
                         return r;
         }
@@ -1618,7 +1618,7 @@ static int exec_parameters_deserialize(ExecParameters *p, FILE *f, FDSet *fds) {
                         if (fd < 0)
                                 continue;
 
-                        p->bpf_outer_map_fd = fd;
+                        p->bpf_restrict_fs_map_fd = fd;
                 } else if ((val = startswith(l, "exec-parameters-notify-socket="))) {
                         r = free_and_strdup(&p->notify_socket, val);
                         if (r < 0)
diff --git a/src/core/execute.c b/src/core/execute.c
index 5c10aabc7e..d4095ae01a 100644
--- a/src/core/execute.c
+++ b/src/core/execute.c
@@ -2499,7 +2499,7 @@ void exec_params_shallow_clear(ExecParameters *p) {
         p->fds = mfree(p->fds);
         p->exec_fd = safe_close(p->exec_fd);
         p->user_lookup_fd = -EBADF;
-        p->bpf_outer_map_fd = -EBADF;
+        p->bpf_restrict_fs_map_fd = -EBADF;
         p->unit_id = mfree(p->unit_id);
         p->invocation_id = SD_ID128_NULL;
         p->invocation_id_string[0] = '\0';
diff --git a/src/core/execute.h b/src/core/execute.h
index e3708e1b01..6f91309b16 100644
--- a/src/core/execute.h
+++ b/src/core/execute.h
@@ -453,7 +453,8 @@ struct ExecParameters {
 
         char **files_env;
         int user_lookup_fd;
-        int bpf_outer_map_fd;
+
+        int bpf_restrict_fs_map_fd;
 
         /* Used for logging in the executor functions */
         char *unit_id;
@@ -461,16 +462,16 @@ struct ExecParameters {
         char invocation_id_string[SD_ID128_STRING_MAX];
 };
 
-#define EXEC_PARAMETERS_INIT(_flags)        \
-        (ExecParameters) {                  \
-                .flags = (_flags),          \
-                .stdin_fd         = -EBADF, \
-                .stdout_fd        = -EBADF, \
-                .stderr_fd        = -EBADF, \
-                .exec_fd          = -EBADF, \
-                .bpf_outer_map_fd = -EBADF, \
-                .user_lookup_fd   = -EBADF, \
-        };
+#define EXEC_PARAMETERS_INIT(_flags)              \
+        (ExecParameters) {                        \
+                .flags = (_flags),                \
+                .stdin_fd               = -EBADF, \
+                .stdout_fd              = -EBADF, \
+                .stderr_fd              = -EBADF, \
+                .exec_fd                = -EBADF, \
+                .bpf_restrict_fs_map_fd = -EBADF, \
+                .user_lookup_fd         = -EBADF, \
+        }
 
 #include "unit.h"
 #include "dynamic-user.h"
diff --git a/src/core/fuzz-execute-serialize.c b/src/core/fuzz-execute-serialize.c
index 6069efd519..5b2dc952ad 100644
--- a/src/core/fuzz-execute-serialize.c
+++ b/src/core/fuzz-execute-serialize.c
@@ -56,7 +56,7 @@ static void exec_fuzz_one(FILE *f, FDSet *fdset) {
         params.stderr_fd = -EBADF;
         params.exec_fd = -EBADF;
         params.user_lookup_fd = -EBADF;
-        params.bpf_outer_map_fd = -EBADF;
+        params.bpf_restrict_fs_map_fd = -EBADF;
         if (!params.fds)
                 params.n_socket_fds = params.n_storage_fds = 0;
         for (size_t i = 0; params.fds && i < params.n_socket_fds + params.n_storage_fds; i++)
diff --git a/src/core/load-fragment.c b/src/core/load-fragment.c
index 5f4e642e54..819cbb2772 100644
--- a/src/core/load-fragment.c
+++ b/src/core/load-fragment.c
@@ -16,8 +16,8 @@
 #include "all-units.h"
 #include "alloc-util.h"
 #include "bpf-firewall.h"
-#include "bpf-lsm.h"
 #include "bpf-program.h"
+#include "bpf-restrict-fs.h"
 #include "bpf-socket-bind.h"
 #include "bus-error.h"
 #include "bus-internal.h"
@@ -3697,7 +3697,7 @@ int config_parse_restrict_filesystems(
                         break;
                 }
 
-                r = lsm_bpf_parse_filesystem(
+                r = bpf_restrict_fs_parse_filesystem(
                               word,
                               &c->restrict_filesystems,
                               FILESYSTEM_PARSE_LOG|
diff --git a/src/core/main.c b/src/core/main.c
index 10f60c2425..1e66770df0 100644
--- a/src/core/main.c
+++ b/src/core/main.c
@@ -21,7 +21,7 @@
 #include "architecture.h"
 #include "argv-util.h"
 #if HAVE_LIBBPF
-#include "bpf-lsm.h"
+#include "bpf-restrict-fs.h"
 #endif
 #include "build.h"
 #include "bus-error.h"
diff --git a/src/core/manager.c b/src/core/manager.c
index 47244a4a26..5014c3e1c8 100644
--- a/src/core/manager.c
+++ b/src/core/manager.c
@@ -992,8 +992,8 @@ int manager_new(RuntimeScope runtime_scope, ManagerTestRunFlags test_run_flags,
                         return r;
 
 #if HAVE_LIBBPF
-                if (MANAGER_IS_SYSTEM(m) && lsm_bpf_supported(/* initialize = */ true)) {
-                        r = lsm_bpf_setup(m);
+                if (MANAGER_IS_SYSTEM(m) && bpf_restrict_fs_supported(/* initialize = */ true)) {
+                        r = bpf_restrict_fs_setup(m);
                         if (r < 0)
                                 log_warning_errno(r, "Failed to setup LSM BPF, ignoring: %m");
                 }
@@ -1710,7 +1710,7 @@ Manager* manager_free(Manager *m) {
         m->fw_ctx = fw_ctx_free(m->fw_ctx);
 
 #if BPF_FRAMEWORK
-        lsm_bpf_destroy(m->restrict_fs);
+        bpf_restrict_fs_destroy(m->restrict_fs);
 #endif
 
         safe_close(m->executor_fd);
diff --git a/src/core/meson.build b/src/core/meson.build
index 7701d3de0a..bda4a3450e 100644
--- a/src/core/meson.build
+++ b/src/core/meson.build
@@ -7,7 +7,8 @@ libcore_sources = files(
         'bpf-devices.c',
         'bpf-firewall.c',
         'bpf-foreign.c',
-        'bpf-lsm.c',
+        'bpf-restrict-fs.c',
+        'bpf-restrict-ifaces.c',
         'bpf-socket-bind.c',
         'cgroup.c',
         'core-varlink.c',
@@ -51,7 +52,6 @@ libcore_sources = files(
         'mount.c',
         'namespace.c',
         'path.c',
-        'restrict-ifaces.c',
         'scope.c',
         'selinux-access.c',
         'selinux-setup.c',
diff --git a/src/core/unit-serialize.c b/src/core/unit-serialize.c
index 40cdb615be..297bf771b7 100644
--- a/src/core/unit-serialize.c
+++ b/src/core/unit-serialize.c
@@ -1,5 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
+#include "bpf-restrict-ifaces.h"
 #include "bpf-socket-bind.h"
 #include "bus-util.h"
 #include "dbus.h"
@@ -7,7 +8,6 @@
 #include "fileio.h"
 #include "format-util.h"
 #include "parse-util.h"
-#include "restrict-ifaces.h"
 #include "serialize.h"
 #include "string-table.h"
 #include "unit-serialize.h"
@@ -191,7 +191,7 @@ int unit_serialize_state(Unit *u, FILE *f, FDSet *fds, bool switching_root) {
         (void) serialize_cgroup_mask(f, "cgroup-enabled-mask", u->cgroup_enabled_mask);
         (void) serialize_cgroup_mask(f, "cgroup-invalidated-mask", u->cgroup_invalidated_mask);
 
-        (void) bpf_serialize_socket_bind(u, f, fds);
+        (void) bpf_socket_bind_serialize(u, f, fds);
 
         (void) bpf_program_serialize_attachment(f, fds, "ip-bpf-ingress-installed", u->ip_bpf_ingress_installed);
         (void) bpf_program_serialize_attachment(f, fds, "ip-bpf-egress-installed", u->ip_bpf_egress_installed);
@@ -199,7 +199,7 @@ int unit_serialize_state(Unit *u, FILE *f, FDSet *fds, bool switching_root) {
         (void) bpf_program_serialize_attachment_set(f, fds, "ip-bpf-custom-ingress-installed", u->ip_bpf_custom_ingress_installed);
         (void) bpf_program_serialize_attachment_set(f, fds, "ip-bpf-custom-egress-installed", u->ip_bpf_custom_egress_installed);
 
-        (void) serialize_restrict_network_interfaces(u, f, fds);
+        (void) bpf_restrict_ifaces_serialize(u, f, fds);
 
         if (uid_is_valid(u->ref_uid))
                 (void) serialize_item_format(f, "ref-uid", UID_FMT, u->ref_uid);
@@ -445,7 +445,7 @@ int unit_deserialize_state(Unit *u, FILE *f, FDSet *fds) {
 
                         fd = deserialize_fd(fds, v);
                         if (fd >= 0)
-                                (void) restrict_network_interfaces_add_initial_link_fd(u, fd);
+                                (void) bpf_restrict_ifaces_add_initial_link_fd(u, fd);
 
                         continue;
 
diff --git a/src/core/unit.c b/src/core/unit.c
index 6496fc96d4..fd652df35b 100644
--- a/src/core/unit.c
+++ b/src/core/unit.c
@@ -5355,12 +5355,12 @@ int unit_set_exec_params(Unit *u, ExecParameters *p) {
 
         p->fallback_smack_process_label = u->manager->defaults.smack_process_label;
 
-        if (u->manager->restrict_fs && p->bpf_outer_map_fd < 0) {
-                int fd = lsm_bpf_map_restrict_fs_fd(u);
+        if (u->manager->restrict_fs && p->bpf_restrict_fs_map_fd < 0) {
+                int fd = bpf_restrict_fs_map_fd(u);
                 if (fd < 0)
                         return fd;
 
-                p->bpf_outer_map_fd = fd;
+                p->bpf_restrict_fs_map_fd = fd;
         }
 
         p->user_lookup_fd = u->manager->user_lookup_fds[1];
diff --git a/src/test/meson.build b/src/test/meson.build
index 5acf5b4a61..ef741388d5 100644
--- a/src/test/meson.build
+++ b/src/test/meson.build
@@ -478,7 +478,7 @@ executables += [
                 'sources' : files('test-bpf-foreign-programs.c'),
         },
         core_test_template + {
-                'sources' : files('test-bpf-lsm.c'),
+                'sources' : files('test-bpf-restrict-fs.c'),
                 'dependencies' : common_test_dependencies,
         },
         core_test_template + {
diff --git a/src/test/test-bpf-lsm.c b/src/test/test-bpf-restrict-fs.c
similarity index 97%
rename from src/test/test-bpf-lsm.c
rename to src/test/test-bpf-restrict-fs.c
index 42ea64cd0a..e1d56163ef 100644
--- a/src/test/test-bpf-lsm.c
+++ b/src/test/test-bpf-restrict-fs.c
@@ -1,6 +1,6 @@
 /* SPDX-License-Identifier: LGPL-2.1-or-later */
 
-#include "bpf-lsm.h"
+#include "bpf-restrict-fs.h"
 #include "load-fragment.h"
 #include "manager.h"
 #include "process-util.h"
@@ -75,7 +75,7 @@ int main(int argc, char *argv[]) {
         if (!can_memlock())
                 return log_tests_skipped("Can't use mlock()");
 
-        if (!lsm_bpf_supported(/* initialize = */ true))
+        if (!bpf_restrict_fs_supported(/* initialize = */ true))
                 return log_tests_skipped("LSM BPF hooks are not supported");
 
         r = enter_cgroup_subroot(NULL);