We read every piece of feedback, and take your input very seriously.
To see all available qualifiers, see our documentation.
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Implement custom version of CO-RE BPF probe, following the same approach as for the custom EBPF one. The proposed solution:
Restructure current kernel-modules/probe to contain two subdirectories, ebpf and core_bpf for custom ebpf and core_bpf probes correspondingly.
kernel-modules/probe
ebpf
core_bpf
Construct a cmake configuration, similar to that in Falco, to build separate probes with modern_bpf dependencies.
modern_bpf
For each captured syscall introduce one probe with two BPF progs tp_btf/sys_{enter|exit}_syscall, similar to attached progs from Falco.
tp_btf/sys_{enter|exit}_syscall
Teach the cmake configuration to assemble the final probe by picking up the custom bits and the actual tail-called BPF program from the Falco build.
Verify it's limitations for other architectures.
The text was updated successfully, but these errors were encountered:
No branches or pull requests
Implement custom version of CO-RE BPF probe, following the same approach as for
the custom EBPF one. The proposed solution:
Restructure current
kernel-modules/probe
to contain two subdirectories,ebpf
andcore_bpf
for custom ebpf and core_bpf probes correspondingly.Construct a cmake configuration, similar to that in Falco, to build
separate probes with
modern_bpf
dependencies.For each captured syscall introduce one probe with two BPF progs
tp_btf/sys_{enter|exit}_syscall
, similar to attached progs from Falco.Teach the cmake configuration to assemble the final probe by picking up the
custom bits and the actual tail-called BPF program from the Falco build.
Verify it's limitations for other architectures.
The text was updated successfully, but these errors were encountered: