Skip to content

Custom CO-RE BPF probe #1320

@erthalion

Description

@erthalion

Implement custom version of CO-RE BPF probe, following the same approach as for
the custom EBPF one. The proposed solution:

  • Restructure current kernel-modules/probe to contain two subdirectories,
    ebpf and core_bpf for custom ebpf and core_bpf probes correspondingly.

  • Construct a cmake configuration, similar to that in Falco, to build
    separate probes with modern_bpf dependencies.

  • For each captured syscall introduce one probe with two BPF progs
    tp_btf/sys_{enter|exit}_syscall, similar to attached progs from Falco.

  • Teach the cmake configuration to assemble the final probe by picking up the
    custom bits and the actual tail-called BPF program from the Falco build.

  • Verify it's limitations for other architectures.

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions