Jeff Wooldridge

icon location Linux security products is my passion. Kernel, BPF and trace tools are fun to create. Access Control architecture and design is fun.

Results 2 comments of Jeff Wooldridge

File create high-level event

For pure research `d_instantiate` is great and helpful for determining default security context for new files. Not sure about BPF though.

Investigate BPF Ring Buffer Map Usage

Yes. One of the main reasons to switch the BPF Map based ring buffer when available. Since all of our events are tied to a single perf buffer across the...