Skip to content

Home

Jump to bottom
thefoulowl edited this page Sep 4, 2026 · 3 revisions

provctl

provctl is an eBPF-based process/file/network provenance tracker and flight recorder for Linux. One capture engine, two questions:

$ provctl trace ~/Downloads/payload.sh
cp (pid 132382)
  ↓ opened /home/user/Downloads/payload.sh                (08:49:49)
  ↓ opened by bash (pid 132380)                            (08:49:49)
  ↓ executed as payload.sh (pid 132384)                    (08:49:49)
        -> spawned curl (pid 132385)                       (08:49:49)

That output is from a real recorded run on the developer's machine, not a mockup — see Architecture for how it's built and Known Limitations & Roadmap for what it can't yet do.

Wiki contents

  • Installation — building from source, requirements, and distro packages (rpm/deb/AUR).
  • Usage — every subcommand, its flags, and what it needs (root vs. read-only).
  • Architecture — the five eBPF hooks, the event flow from kernel ring buffer to SQLite, and why each hook was chosen.
  • BPF Hooks Reference — per-hook attach point, event fields, and why fentry vs. tracepoint was chosen for each.
  • Known Limitations & Roadmap — what v1 deliberately doesn't do yet, and why.

Quick links

Clone this wiki locally