cbsensor-linux-bpf
cbsensor-linux-bpf copied to clipboard
Use Dynamic Kprobe Naming Convention Where it Fits
Kprobe hooks that are relatively stable or properly ifdefed to work on the right kernel versions won't have to worry about explcitly attaching the kprobes.
- This should be enabled for at least the core probes related to cache cleanups and core event generation
Probes end users do not want to obtain events from can later detach the kprobes or eventually utilize a global BPF Map array used as sentinel value for feature enablement. For example we will always want the security_task_free kprobe attached but may not want to return task exit BPF messages.