[bug]: Host OS Permission Issues for Tracepoints

👀 Is there an existing issue for this?

• I have searched and didn't find similar issue

👍 Current behavior

When I run Keploy with keploy record -c "./my-app", the application fails to start and I see permission denied errors related to eBPF tracepoints. Keploy cannot capture any network traffic.

What I expect is that Keploy should successfully attach eBPF tracepoints and start capturing API traffic for test generation.

👟 Steps to Replicate

1. Install Keploy on Linux system
2. Run keploy record -c "./my-app"
3. Observe permission denied errors in logs
4. See that no traffic is captured and no test cases are generated

📜 Logs (if any)

ERROR: Failed to attach eBPF tracepoint: operation not permitted
ERROR: Permission denied accessing /sys/kernel/debug/tracing
FATAL: Cannot initialize eBPF capture module

💻 Operating system

Linux

🧾 System Info (uname -a)

Linux ubuntu-server 5.15.0-91-generic #101-Ubuntu SMP x86_64 GNU/Linux

📦 OS Release Info (cat /etc/os-release)

NAME="Ubuntu"
VERSION="22.04.3 LTS (Jammy Jellyfish)"
ID=ubuntu
ID_LIKE=debian
VERSION_ID="22.04"

🐳 Docker Info (if applicable)

running inside Docker.

• Docker version: 24.0.7
• Docker Desktop version: N/A (Docker Engine on Linux)
• Build image: golang:1.21
• Runtime image: ubuntu:22.04
• Running without --privileged flag
• Missing CAP_BPF, CAP_NET_ADMIN, CAP_SYS_ADMIN capabilities

🧱 Your Environment

• Running on local Docker container
• Non-root user execution
• SELinux enabled
• Restricted security context

🎲 Version

Keploy version v2.5.2

📦 Repository

keploy

🤔 What use case were you trying? (optional)

I was trying to capture test cases for a REST API application during development. Need to record API calls and generate mocks for integration testing.

Start by reproducing keploy record -c "./my-app" in the reported Ubuntu 22.04 Docker environment, then trace the eBPF capture module's initialization and permission checks. No source file or test is named; done means recording can attach the tracepoints and capture API traffic under the documented container capabilities, or reports the required permissions clearly.