aquasecurity / aquasecurity/tracee

Use BPF_PROG_TYPE_TRACING programs for kernels >= 5.5

Open
#475 1 comment 0 reactions 0 assignees View on GitHub
area/ebpf kind/feature priority/backlog
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

Starting from kernel 5.5, a new type of bpf programs is supported, called BPF_PROG_TYPE_TRACING, which uses fentry/fexit for attachment (https://lwn.net/Articles/804937/)
Such programs have zero overhead compared to kprobes, and are thus preferable.
We should use these as the default for kernels >= 5.5

Contributor guide

Open the contributing guide

Research direction

Start by locating the existing kprobe attachment setup and the kernel-version checks in the repository; the issue does not name specific files or tests. The work is done when kernels >= 5.5 use BPF_PROG_TYPE_TRACING with fentry/fexit by default, while the existing behavior remains available where needed.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, linux
Domain
operating-systems, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
38/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.