tracee icon indicating copy to clipboard operation
tracee copied to clipboard

Published 20 hours ago • verified publisher icon aquasecurity

eBPF CO-RE functionality improvements

Open grantseltzer opened this issue 3 years ago • 2 comments

  • [ ] Make use of bpf global variables for configuration and other read-only applications (#784, https://github.com/aquasecurity/libbpfgo/issues/27)
  • [ ] #476
  • [ ] #475
  • [ ] #474
  • [ ] Remove always_inline attribute from functions that no longer need them based on kernel version (needs investigation)
  • [ ] #1636

grantseltzer avatar Mar 30 '22 18:03 grantseltzer

Regarding removing the always_inline attribute, please note that this doesn't play well with tail calls, as explained here: https://docs.cilium.io/en/stable/bpf/#bpf-to-bpf-calls

yanivagman avatar Mar 31 '22 07:03 yanivagman

Also, there is this one (bounded loops since 5.3): https://github.com/aquasecurity/tracee/issues/474 (Not related to CO-RE but to new BPF features that we should support)

yanivagman avatar Mar 31 '22 08:03 yanivagman

No need for this epic. Let's stay with individual issues

yanivagman avatar May 28 '23 14:05 yanivagman