Skip to content

[Spike] Use BPF_ITER to enumerate already running processes #155

@lrishi

Description

@lrishi

Currently, eBPF sensor does not report already running processes.

Investigate use of a BPF_ITER program to enumerate all the already running tasks
(and consequently, disable the already running logic in endpoint when eBPF sensor is used)

Resources/References:
https://developers.facebook.com/blog/post/2022/03/31/bpf-iterator-retrieving-kernel-data-with-flexibility-and-efficiency/
https://elixir.bootlin.com/linux/latest/source/kernel/bpf/bpf_iter.c

Metadata

Metadata

Assignees

Labels

No labels
No labels

Type

No type

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions