execsnoop not working because of symbol changes in kernels >= 4.17
Open
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 10d 4h
- Merged PRs (30d)
- 3
Description
Many symbols were renamed for ia32 and x64 in this change: https://github.com/torvalds/linux/commit/d5a00528b58cdb2c71206e18bd021e34c4eab878
For example, on x64, `sys_execve` becomes `__x64_sys_execve`.
I'm sure other examples and tools tools are affected too, but I only tried execsnoop.
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reproducing execsnoop on a kernel >=4.17 and compare the symbols it expects with the renamed kernel symbols described in the issue. Inspect the execsnoop entry point and any other affected tools, then verify that execsnoop works with the newer symbol names without breaking supported kernels.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- linux
- Domain
- devtools, operating-systems
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100