iovisor / iovisor/bcc

execsnoop not working because of symbol changes in kernels >= 4.17

Open
#1,869 3 comments 2 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
10d 4h
Merged PRs (30d)
3

Description

Many symbols were renamed for ia32 and x64 in this change: https://github.com/torvalds/linux/commit/d5a00528b58cdb2c71206e18bd021e34c4eab878

For example, on x64, `sys_execve` becomes `__x64_sys_execve`.

I'm sure other examples and tools tools are affected too, but I only tried execsnoop.

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing execsnoop on a kernel >=4.17 and compare the symbols it expects with the renamed kernel symbols described in the issue. Inspect the execsnoop entry point and any other affected tools, then verify that execsnoop works with the newer symbol names without breaking supported kernels.

Written by the indexing model from the issue text.

Assessment

Tech stack
linux
Domain
devtools, operating-systems
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.