syscall-recorder

Requirements

Build time

• bpftool
• clang
• libbpf
• libelf
• libseccomp (for converting the syscall IDs to names)
• libz
• llvm (llvm-strip)

Build procedure

Running make invokes a series of commands to build the application:

1. Creates a vmlinux.h via bpftool btf dump file
2. Builds the ebpf application object via clang -target bpf
3. Strips the object via llvm-strip
4. Generate the skeleton (.skel.h) from the object via bpftool gen skeleton
5. Compile the application by using the skeleton and link the required libs

Runtime

• libbpf
• libelf
• libseccomp
• libz