The cilium/ebpf defines sys.FD's SetFinalizer to close fd when GC.
Since the exec process's exit code needs memory-type exitsnoop, we
should keep the reference on the raw_tp link. Otherwise, the exitsnoop
will be gone and process's exit code will be wrong.
The cilium/ebpf defines sys.FD's SetFinalizer to close fd when GC. Since the exec process's exit code needs memory-type exitsnoop, we should keep the reference on the raw_tp link. Otherwise, the exitsnoop will be gone and process's exit code will be wrong.
Signed-off-by: Wei Fu fuweid89@gmail.com