Mattia Meleleo

link: implement kprobe.multi link

6

Leaving as draft until CI supports 5.18. Also, support for pattern matching and addresses array (which libbpf already supports) is to be evaluated Edit: I've added support for addresses array,...

Both the FDs need to remain open for the link lifetime. See https://github.com/cilium/ebpf/blob/v0.14.0/link/perf_event.go#L89

ci: uprobes integration test on Go binaries fails on kernel < 4.14

7

[This test](https://github.com/cilium/ebpf/blob/master/link/uprobe_test.go#L338) should pass once this get fixed

Fallback to `sys.RawTracepointOpen()` when not possible. I've exported the Program's `AttachType` since it's needed when creating the link, the alternative would be to have separate functions for the different attach...

[Auditbeat] fim(ebpf): enrich file events with process data

9

## Proposed commit message fim(ebpf): enrich file events with process data ## Checklist - [x] My code follows the style guidelines of this project - [x] I have commented my...

## Description Add container image digest to container meta when using docker runtime ## Testing done - [x] Unit tests - [x] Manual test before: ``` "containerMeta":{ "runtimeName":"docker", "containerID":"24878827d73c97435ad1ceee6fc5fc26f402723065e557bb4d1934b61a7fd8ab", "containerName":"competent_swanson",...

update: align protos to latest version, bump dependencies, bump version to 0.5.0

2

**What type of PR is this?** /kind cleanup **Any specific area of the project related to this PR?** /area client **What this PR does / why we need it**: **Which...

Investigate whether it's possible to make PathResolver more resilient to long paths

1

Podman / overlayfs: ``` {"event_type":"FILE_RENAME","pids": ...,"old_path":"./test","new_path":"./test2"} ``` ``` mv-170700 [003] d... 9717.441932: bpf_trace_printk: path truncated mv-170700 [003] d... 9717.441938: bpf_trace_printk: path truncated ``` Check if the bottleneck is `PATH_RESOLVER_MAX_COMPONENTS` or...

bpf: sql: parse error response

3

This PR parses tcp sql error responses for mysql and postgres. TODO: fix integration tests