aquasecurity / aquasecurity/tracee
Use BPF_PROG_TYPE_TRACING programs for kernels >= 5.5
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
Starting from kernel 5.5, a new type of bpf programs is supported, called BPF_PROG_TYPE_TRACING, which uses fentry/fexit for attachment (https://lwn.net/Articles/804937/)
Such programs have zero overhead compared to kprobes, and are thus preferable.
We should use these as the default for kernels >= 5.5
Contributor guide
Research direction
Start by locating the existing kprobe attachment setup and the kernel-version checks in the repository; the issue does not name specific files or tests. The work is done when kernels >= 5.5 use BPF_PROG_TYPE_TRACING with fentry/fexit by default, while the existing behavior remains available where needed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 38/100