aquasecurity / aquasecurity/tracee
Add io_uring tracepoints
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
io_uring is a relatively new and interesting interface between the user space and the kernel.
It is built around a ring buffer in memory shared between user space and the kernel, that allows the submission of operations (and collecting the results) without the need to call into the kernel in many cases.
With io_uring, a program doesn't have to call system calls to performs operations like open, close, read, write and more (for more info: https://lwn.net/Articles/810414/). For this reason, it is also interesting from a security perspective.
We should add support in tracee for the relevant io_uring tracepoints, as defined in:
https://github.com/torvalds/linux/blob/master/include/trace/events/io_uring.h
Contributor guide
Assessment
This issue has not been assessed yet.