Extract cgroup in bpf programs - Githubissues

exein-io / pulsar

A modular and blazing fast runtime security tool for the IoT, powered by eBPF.

https://pulsar.sh

Other

905 stars 51 forks source link

Extract cgroup in bpf programs #240

Closed banditopazzo closed 9 months ago

banditopazzo commented 9 months ago

This PR wants to change the way cgroups are collected for processes at runtime.

The idea is to move cgroup extraction to BPF because procfs is not reliable.

remaining tasks

[x] found reliable way to read cgroup from cgroups->subsys. https://github.com/aya-rs/aya/issues/868
[x] fix out of range errors on nut https://github.com/Reeywhaar/nut/issues/4
[x] vmlinux.h with memory_cgrp_id for x86_64 #241
[x] clean is_new_container functions and map
[x] clean BPF logs and dev comments