aquasecurity / aquasecurity/tracee
Use BTF enabled raw tracepoints on BTF enabled kernels
Open
priority/backlog
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
As talked about [here](https://nakryiko.com/posts/bpf-core-reference-guide/#btf-enabled-bpf-program-types-with-direct-memory-reads) we can use new BTF enabled tracepoints in favor of raw_tracepoints that we use now. This allows us to do direct memory accesses and not use bpf_core_read() helpers, increasing efficiency
Contributor guide
Assessment
This issue has not been assessed yet.