aquasecurity / aquasecurity/tracee

Use BTF enabled raw tracepoints on BTF enabled kernels

Open
#1,636 0 comments 1 reaction 1 assignee Claimed by @grantseltzer View on GitHub
priority/backlog
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

As talked about [here](https://nakryiko.com/posts/bpf-core-reference-guide/#btf-enabled-bpf-program-types-with-direct-memory-reads) we can use new BTF enabled tracepoints in favor of raw_tracepoints that we use now. This allows us to do direct memory accesses and not use bpf_core_read() helpers, increasing efficiency

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.