search

elastic / ebpf

Elastic's eBPF
Other
67 stars 11 forks source link

EventProbe: Compatibility with Kernels >= 5.10 #66

Closed fntlnz closed 2 years ago

fntlnz commented 2 years ago

We agreed that as a starting point, for the EventProbe (network, file and process) , we want to support kernels >= 5.10.

We need to make sure our usage of helpers and function arguments is compatible with this requirement.

fntlnz commented 2 years ago

Regarding file events,https://github.com/elastic/ebpf/pull/65 contains the changes to make them compatible with this requirement. A lot of work in that direction has been done with function arguments relocation in https://github.com/elastic/ebpf/pull/55

mmat11 commented 2 years ago

Closing this as we now have specific issues: https://github.com/elastic/ebpf/issues/91, https://github.com/elastic/ebpf/issues/92. Existing helpers have been adjusted already.