exein-io / pulsar

A modular and blazing fast runtime security tool for the IoT, powered by eBPF.
https://pulsar.sh
Other
888 stars 51 forks source link

refactor: Replace `LINUX_KERNEL_VERSION` checks with checks on `bpf_func_id` #275

Closed vadorovsky closed 4 months ago

vadorovsky commented 5 months ago

Checking kernel version is not the most reliable way of determining whether a given BPF feature is present in the kernel. Many distributions backport BPF features to older kernel versions.

Kernel provides the enum bpf_func_id which contains BPF_FUNC_* variants. In combination with bpf_core_enum_value_exists, it can be used to determine whether the given function is supported by the running kernel.

Fixes: #261