[WIP] system-monitor: bcc -> libbpf #399
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
humancalico
force-pushed
the
libbpf
branch
3 times, most recently
from
3d62adc
to
7fd4a69
Compare
humancalico
force-pushed
the
libbpf
branch
7 times, most recently
from
10028f5
to
792241e
Compare
* We now pre-compile the system_monitor.bpf.c file in the Makefile into different object files based on the -D flags. Reason: In bcc we were previously using the NewModule function which takes the BPF C source file and the C flags as arguments and compiles the BPF code at runtime. Since we won't have this functionality in libbpf we pre-compile the BPF C source files considering all the different -D flags and load them accordingly * Some of the BPF changes are taken from tracee https://github.com/aquasecurity/tracee/blob/611c20/tracee-ebpf/tracee/tracee.bpf.c Co-authored-by: Geyslan G. Bem <geyslan@accuknox.com>
|
cc @weirdwiz @oneiro-naut @geyslan for review |
|
This PR is for #38 and it will be merged when KubeArmor supports libbpf inside the KubeArmor daemonset. |
oneiro-naut
reviewed
Nov 18, 2021
| mon.BpfModule = bcc.NewModule(bpfSource, []string{"-O2"}) | ||
| if mon.BpfModule == nil { | ||
| return errors.New("bpf module is nil") | ||
| mon.BpfModule, err = lbpf.OpenObjectFromFile(bpfObjPath + "system_monitor.bpf.o") |
There was a problem hiding this comment.
Does this function call assume that the object file is already there(ie the bpf code is already compiled)?
There was a problem hiding this comment.
Sorry didn't see this before. Yes it does assume that
3 tasks
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Some TODOs (or maybe they should come in a different PR?)