iovisor / iovisor/bcc

How to generate BPF code(`sock_fprog`) through bcc?

Open
#2,492 4 comments 0 reactions 0 assignees View on GitHub
Dominant language
C
Stars
22.7k
Forks
4.1k
Avg merge
5d 13h
Merged PRs (30d)
3

Description

Hi, I am planning to generate the BPF "assembly" code(`BPF_JUMP`, `BPF_STMT` etc.) by writing C or Python code.
```
struct sock_filter filter[] = {
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, nr))),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_prctl, 0, 1),
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_write, 0, 1),
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
};
```

I was wondering if bcc could provide such interfaces to users. Since what I have found is all about higher API (like tracing), Thanks~

Contributor guide

No contributing guide indexed for this repository

Research direction

The issue names no files or tests; start by reviewing BCC's existing higher-level tracing APIs and the requested sock_fprog, BPF_STMT, and BPF_JUMP interfaces. Done would require a decided, supported interface for generating this code, along with coverage or documentation showing how users should use it.

Written by the indexing model from the issue text.

Assessment

Tech stack
c, linux
Domain
operating-systems, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.