search

elastic / ebpf

Elastic's eBPF
Other
67 stars 11 forks source link

update(GPL/EventProbe): remove usage of _btf task helper from vfs_unlink #65

Closed fntlnz closed 2 years ago

fntlnz commented 2 years ago

Co-Authored-By: Leonardo Di Donato leonardo.didonato@elastic.co Co-Authored-By: Mattia Meleleo mattia.meleleo@elastic.co

nicholasberlin commented 2 years ago

Just curious ... why was this change necessary?

fntlnz commented 2 years ago

@nicholasberlin we're trying to keep file events compatible with kernels >= 5.10, the bpf_get_current_task_btf is not available there.

fntlnz commented 2 years ago

@nicholasberlin correct, and we need to go trough all the other parts in the code base that use the same helper and change the functions we pass the task structn to accordingly. Opened an issue for tracking this https://github.com/elastic/ebpf/issues/66