search

elastic / quark

Other
6 stars 1 forks source link

Consider adding ENV #33

Open haesbaert opened 4 months ago

haesbaert commented 4 months ago

Env is easy to fetch but we're already on the limit of kprobes, so it won't be 100% reliable, still we should consider adding it, not strictly needed for the session viewer, but good to have.

haesbaert commented 2 months ago

The amount of stack we can read shrinks as humanity descends into chaos. Now that exec tracks the full task_struct, the amount we can get from the stack is even smaller.