roikol
roikol
this PR bumps the version of libbpfgo to make use of https://github.com/aquasecurity/libbpfgo/pull/209. currently failing until #2060 will be solved (change to libbpfgo was already merged).
explaining the usage of both probes: `check_helper_call` and `check_map_func_compatibility`. in this PR i use these two functions for the same purpose - saving for later usage whether or not the...
thank you @rafaeldtinoco !!
> We try to avoid security_path_xxx hooks as these are not compiled into all kernels (gated with CONFIG_SECURITY_PATH). Maybe use security_inode_rename instead? thanks @yanivagman i've now changed it to use...
> d it kept my credits instead of yours because of the local change no problem Rafael, thank you for merging!
i think the easy aaproach which is also good is to check whether its the `runc` process, with `tid == 1`. if it is the case - do not trigger....
current status: **io_uring_create event doesn't work on kernels v5.1 - v5.4:** what should've solved it is was the probe `io_sq_offload_start` which exists in kernels v5.1 - v5.4, but for some...