ebpf icon indicating copy to clipboard operation
ebpf copied to clipboard

[Spike] Use BPF_ITER to enumerate already running processes

Open lrishi opened this issue 3 years ago • 0 comments

Currently, eBPF sensor does not report already running processes.

Investigate use of a BPF_ITER program to enumerate all the already running tasks (and consequently, disable the already running logic in endpoint when eBPF sensor is used)

Resources/References: https://developers.facebook.com/blog/post/2022/03/31/bpf-iterator-retrieving-kernel-data-with-flexibility-and-efficiency/ https://elixir.bootlin.com/linux/latest/source/kernel/bpf/bpf_iter.c

lrishi avatar Oct 01 '22 19:10 lrishi