ebpf
ebpf copied to clipboard
[Spike] Use BPF_ITER to enumerate already running processes
Currently, eBPF sensor does not report already running processes.
Investigate use of a BPF_ITER program to enumerate all the already running tasks (and consequently, disable the already running logic in endpoint when eBPF sensor is used)
Resources/References: https://developers.facebook.com/blog/post/2022/03/31/bpf-iterator-retrieving-kernel-data-with-flexibility-and-efficiency/ https://elixir.bootlin.com/linux/latest/source/kernel/bpf/bpf_iter.c