How to generate BPF code(`sock_fprog`) through bcc?
- Dominant language
- C
- Stars
- 22.7k
- Forks
- 4.1k
- Avg merge
- 5d 13h
- Merged PRs (30d)
- 3
Description
Hi, I am planning to generate the BPF "assembly" code(`BPF_JUMP`, `BPF_STMT` etc.) by writing C or Python code.
```
struct sock_filter filter[] = {
BPF_STMT(BPF_LD+BPF_W+BPF_ABS, (offsetof(struct seccomp_data, nr))),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_prctl, 0, 1),
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
BPF_JUMP(BPF_JMP+BPF_JEQ+BPF_K, __NR_write, 0, 1),
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_ALLOW),
BPF_STMT(BPF_RET+BPF_K, SECCOMP_RET_KILL),
};
```
I was wondering if bcc could provide such interfaces to users. Since what I have found is all about higher API (like tracing), Thanks~
Contributor guide
No contributing guide indexed for this repository
Research direction
The issue names no files or tests; start by reviewing BCC's existing higher-level tracing APIs and the requested sock_fprog, BPF_STMT, and BPF_JUMP interfaces. Done would require a decided, supported interface for generating this code, along with coverage or documentation showing how users should use it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c, linux
- Domain
- operating-systems, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 20/100