[Spike] Use BPF_ITER to enumerate already running processes
Open
- Dominant language
- C
- Stars
- 86
- Forks
- 11
- Avg merge
- 15d 19h
- Merged PRs (30d)
- 1
Description
Currently, eBPF sensor does not report already running processes.
Investigate use of a BPF_ITER program to enumerate all the already running tasks
(and consequently, disable the already running logic in endpoint when eBPF sensor is used)
Resources/References:
https://developers.facebook.com/blog/post/2022/03/31/bpf-iterator-retrieving-kernel-data-with-flexibility-and-efficiency/
https://elixir.bootlin.com/linux/latest/source/kernel/bpf/bpf_iter.c
Contributor guide
No contributing guide indexed for this repository
Assessment
This issue has not been assessed yet.