search

gravitational / teleport

The easiest, and most secure way to access and protect all of your infrastructure.
https://goteleport.com
GNU Affero General Public License v3.0
17.28k stars 1.73k forks source link

Add option to bypass BPF kernel version check #40847

Closed programmerq closed 1 week ago

programmerq commented 4 months ago

What would you like Teleport to do?

Currently, Teleport's kernel version check is a very simple semver comparison. Since RedHat tends to backport many newer kernel features to an older version, there can be kernels that would otherwise work with Teleport's BPF features.

Rather than creating a cherry-picked list of kernel version exceptions to allow the BPF feature to load, a flag or configuration option that allows a user to disable the version check would allow them to use Teleport's enhanced session recording and networking features.

The flag/feature should be properly caveated so anyone using it would be aware that they should exercise due diligence to make sure the kernel they are using actually works with our BPF code.

https://github.com/gravitational/teleport/blob/v15.2.2/lib/bpf/common.go#L104-L113

What problem does this solve?

In particular, the RedHat 8 kernel has many backported BPF features. I ran a test build of the Teleport binary with the version check commented out, and my cursory findings are that enhanced session recording works with 4.18.0-513.24.1.el8_9.x86_64.

Apr 23 19:16:56 localhost.localdomain teleport[36045]: {"argv":["/usr/bin/bash"],"caller":"events/emitter.go:288","cgroup_id":40,"code":"T4000I","component":"audit","ei":0,"event":"session.command","level":"info","login":"root","message":"session.command","namespace":"default","path":"/usr/bin/basename","pid":36124,"ppid":36121,"program":"basename","return_code":0,"server_hostname":"vagrant","server_id":"5a9b5d93-226c-a458-ff46-07fb8e8e9859","sid":"98cfcaea-0129-ffe3-b639-2266c510b4bc","time":"2024-04-23T19:16:56.411Z","timestamp":"2024-04-23T19:16:56Z","uid":"df4fb1e3-bfd3-cfac-d470-f952c55e69d0","user":"jeff"}
Apr 23 19:17:10 localhost.localdomain teleport[36045]: {"argv":["update"],"caller":"events/emitter.go:288","cgroup_id":40,"code":"T4000I","component":"audit","ei":0,"event":"session.command","level":"info","login":"root","message":"session.command","namespace":"default","path":"/usr/bin/yum","pid":36125,"ppid":36081,"program":"yum","return_code":0,"server_hostname":"vagrant","server_id":"5a9b5d93-226c-a458-ff46-07fb8e8e9859","sid":"98cfcaea-0129-ffe3-b639-2266c510b4bc","time":"2024-04-23T19:17:10.505Z","timestamp":"2024-04-23T19:17:10Z","uid":"c0bb170a-7155-5b81-37fe-baead1c432f1","user":"jeff"}
Apr 23 19:17:11 localhost.localdomain teleport[36045]: {"argv":["-p"],"caller":"events/emitter.go:288","cgroup_id":40,"code":"T4000I","component":"audit","ei":0,"event":"session.command","level":"info","login":"root","message":"session.command","namespace":"default","path":"/sbin/ldconfig","pid":36126,"ppid":36125,"program":"ldconfig","return_code":0,"server_hostname":"vagrant","server_id":"5a9b5d93-226c-a458-ff46-07fb8e8e9859","sid":"98cfcaea-0129-ffe3-b639-2266c510b4bc","time":"2024-04-23T19:17:11.597Z","timestamp":"2024-04-23T19:17:11Z","uid":"91d1e39f-a345-4079-2051-9138e5f12241","user":"jeff"}
^C
[root@localhost ~]# uname -a
Linux localhost.localdomain 4.18.0-513.24.1.el8_9.x86_64 #1 SMP Mon Apr 8 11:23:13 EDT 2024 x86_64 x86_64 x86_64 GNU/Linux
Teleport 15.2.2 (modified) on 4.18.0-513.24.1.el8_9.x86_64 - libbpf debug output ```log [root@localhost ~]# journalctl -u teleport _PID=36045 | grep -iC2 bpf Apr 23 19:16:31 localhost.localdomain teleport[36045]: {"caller":"cgroup/cgroup.go:323","component":"cgroups","level":"debug","message":"Mounted cgroup filesystem to /cgroup2.","timestamp":"2024-04-23T19:16:31Z"} Apr 23 19:16:31 localhost.localdomain teleport[36045]: {"caller":"cgroup/cgroup.go:100","component":"cgroups","level":"debug","message":"Teleport session hierarchy mounted at: /cgroup2/teleport/a790671c-1492-015d-114b-39f547c0af60.","timestamp":"2024-04-23T19:16:31Z"} Apr 23 19:16:31 localhost.localdomain teleport[36045]: {"caller":"bpf/bpf.go:166","component":"bpf","level":"debug","message":"Starting enhanced session recording.","timestamp":"2024-04-23T19:16:31Z"} Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: loading object 'command' from buffer Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(2) .text, size 2704, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.text': found program 'enter_execve' at insn offset 0 (0 bytes), code size 267 insns (2136 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.text': found program 'exit_execve' at insn offset 267 (2136 bytes), code size 71 insns (568 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(3) .rel.text, size 192, link 19, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(4) tp/syscalls/sys_execve, size 40, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_execve': found program 'tracepoint__syscalls__sys_enter_execve' at insn offset 0 (0 bytes), code size 5 insns (40 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(5) .reltp/syscalls/sys_execve, size 16, link 19, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(6) tp/syscalls/sys_exit_execve, size 32, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_execve': found program 'tracepoint__syscalls__sys_exit_execve' at insn offset 0 (0 bytes), code size 4 insns (32 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(7) .reltp/syscalls/sys_exit_execve, size 16, link 19, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(8) tp/syscalls/sys_execveat, size 40, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_execveat': found program 'tracepoint__syscalls__sys_enter_execveat' at insn offset 0 (0 bytes), code size 5 insns (40 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(9) .reltp/syscalls/sys_execveat, size 16, link 19, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(10) tp/syscalls/sys_exit_execveat, size 32, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_execveat': found program 'tracepoint__syscalls__sys_exit_execveat' at insn offset 0 (0 bytes), code size 4 insns (32 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(11) .reltp/syscalls/sys_exit_execveat, size 16, link 19, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(12) license, size 13, link 0, flags 3, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: license of command is Dual BSD/GPL Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(13) .maps, size 96, link 0, flags 3, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(14) .BTF, size 28567, link 0, flags 0, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(16) .BTF.ext, size 4004, link 0, flags 0, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(19) .symtab, size 696, link 1, flags 0, type=2 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: looking for externs among 29 symbols... Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: collected 0 externs total Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': at sec_idx 13, offset 0. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found type = 1. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found key [8], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found value [12], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found max_entries = 1024. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'execve_events': at sec_idx 13, offset 32. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'execve_events': found type = 27. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'execve_events': found max_entries = 32768. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': at sec_idx 13, offset 48. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found type = 2. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found key [27], sz = 4. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found value [8], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found max_entries = 1. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': at sec_idx 13, offset 80. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': found type = 27. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': found max_entries = 4096. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': collecting relocation for section(2) '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #0: insn #9 against 'monitored_cgroups' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': found map 0 (monitored_cgroups, sec 13, off 0) for insn #9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #1: insn #42 against 'execve_events' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': found map 1 (execve_events, sec 13, off 32) for insn #42 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #2: insn #61 against 'lost_counter' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': found map 2 (lost_counter, sec 13, off 48) for insn #61 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #3: insn #117 against 'execve_events' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': found map 1 (execve_events, sec 13, off 32) for insn #117 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #4: insn #179 against 'execve_events' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': found map 1 (execve_events, sec 13, off 32) for insn #179 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #5: insn #199 against 'lost_counter' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': found map 2 (lost_counter, sec 13, off 48) for insn #199 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #6: insn #210 against 'lost_counter' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': found map 2 (lost_counter, sec 13, off 48) for insn #210 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #7: insn #219 against 'lost_doorbell' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': found map 3 (lost_doorbell, sec 13, off 80) for insn #219 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #8: insn #272 against 'monitored_cgroups' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_execve': found map 0 (monitored_cgroups, sec 13, off 0) for insn #5 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #9: insn #277 against 'execve_events' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_execve': found map 1 (execve_events, sec 13, off 32) for insn #10 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #10: insn #287 against 'lost_counter' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_execve': found map 2 (lost_counter, sec 13, off 48) for insn #20 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #11: insn #297 against 'lost_doorbell' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_execve': found map 3 (lost_doorbell, sec 13, off 80) for insn #30 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_execve': collecting relocation for section(4) 'tp/syscalls/sys_execve' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_execve': relo #0: insn #2 against '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_execve': collecting relocation for section(6) 'tp/syscalls/sys_exit_execve' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_execve': relo #0: insn #1 against '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_execveat': collecting relocation for section(8) 'tp/syscalls/sys_execveat' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_execveat': relo #0: insn #2 against '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_execveat': collecting relocation for section(10) 'tp/syscalls/sys_exit_execveat' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_execveat': relo #0: insn #1 against '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': created successfully, fd=13 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'execve_events': created successfully, fd=14 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': created successfully, fd=15 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': created successfully, fd=16 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_execve': found 2 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: CO-RE relocating [37] struct trace_event_raw_sys_enter: found target candidate [5992] struct trace_event_raw_sys_enter in [vmlinux] Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execve': relo #0: [37] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execve': relo #0: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execve': relo #0: patched insn #0 (LDX/ST/STX) off 24 -> 24 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execve': relo #1: [37] struct trace_event_raw_sys_enter.args[0] (0:2:0 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execve': relo #1: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[0] (0:2:0 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execve': relo #1: patched insn #1 (LDX/ST/STX) off 16 -> 16 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.text': found 4 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: CO-RE relocating [54] struct task_struct: found target candidate [172] struct task_struct in [vmlinux] Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': relo #0: [54] struct task_struct.real_parent (0:74 @ offset 2288) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': relo #0: matching candidate #0 [172] struct task_struct.real_parent (0:68 @ offset 2320) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': relo #0: patched insn #19 (ALU/ALU64) imm 2288 -> 2320 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': relo #1: [54] struct task_struct.tgid (0:72 @ offset 2276) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': relo #1: matching candidate #0 [172] struct task_struct.tgid (0:66 @ offset 2308) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'enter_execve': relo #1: patched insn #26 (ALU/ALU64) imm 2276 -> 2308 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_execve': relo #2: [54] struct task_struct.real_parent (0:74 @ offset 2288) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_execve': relo #2: matching candidate #0 [172] struct task_struct.real_parent (0:68 @ offset 2320) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_execve': relo #2: patched insn #42 (ALU/ALU64) imm 2288 -> 2320 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_execve': relo #3: [54] struct task_struct.tgid (0:72 @ offset 2276) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_execve': relo #3: matching candidate #0 [172] struct task_struct.tgid (0:66 @ offset 2308) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_execve': relo #3: patched insn #49 (ALU/ALU64) imm 2276 -> 2308 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_execve': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: CO-RE relocating [343] struct trace_event_raw_sys_exit: found target candidate [5993] struct trace_event_raw_sys_exit in [vmlinux] Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_execve': relo #0: [343] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_execve': relo #0: matching candidate #0 [5993] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_execve': relo #0: patched insn #0 (LDX/ST/STX) off 16 -> 16 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_execveat': found 2 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execveat': relo #0: [37] struct trace_event_raw_sys_enter.args[2] (0:2:2 @ offset 32) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execveat': relo #0: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[2] (0:2:2 @ offset 32) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execveat': relo #0: patched insn #0 (LDX/ST/STX) off 32 -> 32 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execveat': relo #1: [37] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execveat': relo #1: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execveat': relo #1: patched insn #1 (LDX/ST/STX) off 24 -> 24 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_execveat': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_execveat': relo #0: [343] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_execveat': relo #0: matching candidate #0 [5993] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_execveat': relo #0: patched insn #0 (LDX/ST/STX) off 16 -> 16 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execve': added 267 insns from sub-prog 'enter_execve' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execve': insn #2 relocated, imm 2 points to subprog 'enter_execve' (now at 5 offset) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_execve': added 71 insns from sub-prog 'exit_execve' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_execve': insn #1 relocated, imm 2 points to subprog 'exit_execve' (now at 4 offset) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execveat': added 267 insns from sub-prog 'enter_execve' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_execveat': insn #2 relocated, imm 2 points to subprog 'enter_execve' (now at 5 offset) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_execveat': added 71 insns from sub-prog 'exit_execve' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_execveat': insn #1 relocated, imm 2 points to subprog 'exit_execve' (now at 4 offset) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: loading object 'disk' from buffer Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(2) .text, size 864, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.text': found program 'exit_open' at insn offset 0 (0 bytes), code size 108 insns (864 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(3) .rel.text, size 96, link 27, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(4) tp/syscalls/sys_enter_creat, size 144, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_enter_creat': found program 'tracepoint__syscalls__sys_enter_creat' at insn offset 0 (0 bytes), code size 18 insns (144 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(5) .reltp/syscalls/sys_enter_creat, size 16, link 27, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(6) tp/syscalls/sys_exit_creat, size 32, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_creat': found program 'tracepoint__syscalls__sys_exit_creat' at insn offset 0 (0 bytes), code size 4 insns (32 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(7) .reltp/syscalls/sys_exit_creat, size 16, link 27, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(8) tp/syscalls/sys_enter_open, size 160, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_enter_open': found program 'tracepoint__syscalls__sys_enter_open' at insn offset 0 (0 bytes), code size 20 insns (160 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(9) .reltp/syscalls/sys_enter_open, size 16, link 27, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(10) tp/syscalls/sys_exit_open, size 32, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_open': found program 'tracepoint__syscalls__sys_exit_open' at insn offset 0 (0 bytes), code size 4 insns (32 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(11) .reltp/syscalls/sys_exit_open, size 16, link 27, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(12) tp/syscalls/sys_enter_openat, size 160, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_enter_openat': found program 'tracepoint__syscalls__sys_enter_openat' at insn offset 0 (0 bytes), code size 20 insns (160 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(13) .reltp/syscalls/sys_enter_openat, size 16, link 27, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(14) tp/syscalls/sys_exit_openat, size 32, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_openat': found program 'tracepoint__syscalls__sys_exit_openat' at insn offset 0 (0 bytes), code size 4 insns (32 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(15) .reltp/syscalls/sys_exit_openat, size 16, link 27, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(16) tp/syscalls/sys_enter_openat2, size 216, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_enter_openat2': found program 'tracepoint__syscalls__sys_enter_openat2' at insn offset 0 (0 bytes), code size 27 insns (216 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(17) .reltp/syscalls/sys_enter_openat2, size 16, link 27, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(18) tp/syscalls/sys_exit_openat2, size 32, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_openat2': found program 'tracepoint__syscalls__sys_exit_openat2' at insn offset 0 (0 bytes), code size 4 insns (32 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(19) .reltp/syscalls/sys_exit_openat2, size 16, link 27, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(20) license, size 13, link 0, flags 3, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: license of disk is Dual BSD/GPL Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(21) .maps, size 128, link 0, flags 3, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(22) .BTF, size 4296, link 0, flags 0, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(24) .BTF.ext, size 2132, link 0, flags 0, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(27) .symtab, size 672, link 1, flags 0, type=2 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: looking for externs among 28 symbols... Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: collected 0 externs total Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'infotmp': at sec_idx 21, offset 0. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'infotmp': found type = 1. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'infotmp': found key [8], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'infotmp': found value [12], sz = 24. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'infotmp': found max_entries = 8192. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': at sec_idx 21, offset 32. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found type = 1. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found key [8], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found value [21], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found max_entries = 1024. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'open_events': at sec_idx 21, offset 64. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'open_events': found type = 27. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'open_events': found max_entries = 524288. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': at sec_idx 21, offset 80. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found type = 2. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found key [36], sz = 4. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found value [8], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found max_entries = 1. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': at sec_idx 21, offset 112. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': found type = 27. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': found max_entries = 4096. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': collecting relocation for section(2) '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #0: insn #45 against 'infotmp' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_open': found map 0 (infotmp, sec 21, off 0) for insn #45 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #1: insn #52 against 'monitored_cgroups' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_open': found map 1 (monitored_cgroups, sec 21, off 32) for insn #52 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #2: insn #78 against 'open_events' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_open': found map 2 (open_events, sec 21, off 64) for insn #78 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #3: insn #87 against 'lost_counter' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_open': found map 3 (lost_counter, sec 21, off 80) for insn #87 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #4: insn #97 against 'lost_doorbell' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_open': found map 4 (lost_doorbell, sec 21, off 112) for insn #97 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #5: insn #104 against 'infotmp' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'exit_open': found map 0 (infotmp, sec 21, off 0) for insn #104 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_enter_creat': collecting relocation for section(4) 'tp/syscalls/sys_enter_creat' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_enter_creat': relo #0: insn #12 against 'infotmp' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_creat': found map 0 (infotmp, sec 21, off 0) for insn #12 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_creat': collecting relocation for section(6) 'tp/syscalls/sys_exit_creat' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_creat': relo #0: insn #1 against '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_enter_open': collecting relocation for section(8) 'tp/syscalls/sys_enter_open' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_enter_open': relo #0: insn #14 against 'infotmp' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_open': found map 0 (infotmp, sec 21, off 0) for insn #14 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_open': collecting relocation for section(10) 'tp/syscalls/sys_exit_open' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_open': relo #0: insn #1 against '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_enter_openat': collecting relocation for section(12) 'tp/syscalls/sys_enter_openat' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_enter_openat': relo #0: insn #14 against 'infotmp' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat': found map 0 (infotmp, sec 21, off 0) for insn #14 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_openat': collecting relocation for section(14) 'tp/syscalls/sys_exit_openat' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_openat': relo #0: insn #1 against '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_enter_openat2': collecting relocation for section(16) 'tp/syscalls/sys_enter_openat2' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_enter_openat2': relo #0: insn #21 against 'infotmp' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat2': found map 0 (infotmp, sec 21, off 0) for insn #21 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_openat2': collecting relocation for section(18) 'tp/syscalls/sys_exit_openat2' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.reltp/syscalls/sys_exit_openat2': relo #0: insn #1 against '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'infotmp': created successfully, fd=28 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': created successfully, fd=29 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'open_events': created successfully, fd=30 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': created successfully, fd=31 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': created successfully, fd=32 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_enter_creat': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: CO-RE relocating [46] struct trace_event_raw_sys_enter: found target candidate [5992] struct trace_event_raw_sys_enter in [vmlinux] Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_creat': relo #0: [46] struct trace_event_raw_sys_enter.args[0] (0:2:0 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_creat': relo #0: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[0] (0:2:0 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_creat': relo #0: patched insn #0 (LDX/ST/STX) off 16 -> 16 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_creat': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: CO-RE relocating [57] struct trace_event_raw_sys_exit: found target candidate [5993] struct trace_event_raw_sys_exit in [vmlinux] Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_creat': relo #0: [57] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_creat': relo #0: matching candidate #0 [5993] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_creat': relo #0: patched insn #0 (LDX/ST/STX) off 16 -> 16 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_enter_open': found 2 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_open': relo #0: [46] struct trace_event_raw_sys_enter.args[0] (0:2:0 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_open': relo #0: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[0] (0:2:0 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_open': relo #0: patched insn #0 (LDX/ST/STX) off 16 -> 16 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_open': relo #1: [46] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_open': relo #1: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_open': relo #1: patched insn #1 (LDX/ST/STX) off 24 -> 24 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_open': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_open': relo #0: [57] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_open': relo #0: matching candidate #0 [5993] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_open': relo #0: patched insn #0 (LDX/ST/STX) off 16 -> 16 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_enter_openat': found 2 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat': relo #0: [46] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat': relo #0: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat': relo #0: patched insn #0 (LDX/ST/STX) off 24 -> 24 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat': relo #1: [46] struct trace_event_raw_sys_enter.args[2] (0:2:2 @ offset 32) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat': relo #1: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[2] (0:2:2 @ offset 32) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat': relo #1: patched insn #1 (LDX/ST/STX) off 32 -> 32 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_openat': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_openat': relo #0: [57] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_openat': relo #0: matching candidate #0 [5993] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_openat': relo #0: patched insn #0 (LDX/ST/STX) off 16 -> 16 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_enter_openat2': found 3 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat2': relo #0: [46] struct trace_event_raw_sys_enter.args[2] (0:2:2 @ offset 32) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat2': relo #0: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[2] (0:2:2 @ offset 32) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat2': relo #0: patched insn #0 (LDX/ST/STX) off 32 -> 32 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: CO-RE relocating [72] struct open_how: found target candidate [16577] struct open_how in [vmlinux] Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat2': relo #1: [72] struct open_how.flags (0:0 @ offset 0) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat2': relo #1: matching candidate #0 [16577] struct open_how.flags (0:0 @ offset 0) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat2': relo #1: patched insn #1 (ALU/ALU64) imm 0 -> 0 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat2': relo #2: [46] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat2': relo #2: matching candidate #0 [5992] struct trace_event_raw_sys_enter.args[1] (0:2:1 @ offset 24) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_enter_openat2': relo #2: patched insn #3 (LDX/ST/STX) off 24 -> 24 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'tp/syscalls/sys_exit_openat2': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_openat2': relo #0: [57] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_openat2': relo #0: matching candidate #0 [5993] struct trace_event_raw_sys_exit.ret (0:2 @ offset 16) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_openat2': relo #0: patched insn #0 (LDX/ST/STX) off 16 -> 16 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_creat': added 108 insns from sub-prog 'exit_open' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_creat': insn #1 relocated, imm 2 points to subprog 'exit_open' (now at 4 offset) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_open': added 108 insns from sub-prog 'exit_open' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_open': insn #1 relocated, imm 2 points to subprog 'exit_open' (now at 4 offset) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_openat': added 108 insns from sub-prog 'exit_open' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_openat': insn #1 relocated, imm 2 points to subprog 'exit_open' (now at 4 offset) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_openat2': added 108 insns from sub-prog 'exit_open' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'tracepoint__syscalls__sys_exit_openat2': insn #1 relocated, imm 2 points to subprog 'exit_open' (now at 4 offset) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: loading object 'network' from buffer Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(2) .text, size 1200, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.text': found program 'trace_connect_return' at insn offset 0 (0 bytes), code size 150 insns (1200 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(3) .rel.text, size 128, link 19, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(4) kprobe/tcp_v4_connect, size 112, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'kprobe/tcp_v4_connect': found program 'kprobe__tcp_v4_connect' at insn offset 0 (0 bytes), code size 14 insns (112 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(5) .relkprobe/tcp_v4_connect, size 16, link 19, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(6) kretprobe/tcp_v4_connect, size 40, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'kretprobe/tcp_v4_connect': found program 'kretprobe__tcp_v4_connect' at insn offset 0 (0 bytes), code size 5 insns (40 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(7) .relkretprobe/tcp_v4_connect, size 16, link 19, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(8) kprobe/tcp_v6_connect, size 112, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'kprobe/tcp_v6_connect': found program 'kprobe__tcp_v6_connect' at insn offset 0 (0 bytes), code size 14 insns (112 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(9) .relkprobe/tcp_v6_connect, size 16, link 19, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(10) kretprobe/tcp_v6_connect, size 40, link 0, flags 6, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'kretprobe/tcp_v6_connect': found program 'kretprobe__tcp_v6_connect' at insn offset 0 (0 bytes), code size 5 insns (40 bytes) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(11) .relkretprobe/tcp_v6_connect, size 16, link 19, flags 40, type=9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(12) license, size 13, link 0, flags 3, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: license of network is Dual BSD/GPL Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(13) .maps, size 144, link 0, flags 3, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(14) .BTF, size 24194, link 0, flags 0, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(16) .BTF.ext, size 1660, link 0, flags 0, type=1 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: elf: section(19) .symtab, size 528, link 1, flags 0, type=2 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: looking for externs among 22 symbols... Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: collected 0 externs total Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'currsock': at sec_idx 13, offset 0. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'currsock': found type = 1. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'currsock': found key [8], sz = 4. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'currsock': found value [12], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'currsock': found max_entries = 8192. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': at sec_idx 13, offset 32. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found type = 1. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found key [129], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found value [315], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': found max_entries = 1024. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'ipv4_events': at sec_idx 13, offset 64. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'ipv4_events': found type = 27. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'ipv4_events': found max_entries = 32768. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'ipv6_events': at sec_idx 13, offset 80. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'ipv6_events': found type = 27. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'ipv6_events': found max_entries = 32768. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': at sec_idx 13, offset 96. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found type = 2. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found key [8], sz = 4. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found value [129], sz = 8. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': found max_entries = 1. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': at sec_idx 13, offset 128. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': found type = 27. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': found max_entries = 4096. Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': collecting relocation for section(2) '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #0: insn #9 against 'monitored_cgroups' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': found map 1 (monitored_cgroups, sec 13, off 32) for insn #9 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #1: insn #15 against 'currsock' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': found map 0 (currsock, sec 13, off 0) for insn #15 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #2: insn #68 against 'ipv4_events' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': found map 2 (ipv4_events, sec 13, off 64) for insn #68 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #3: insn #77 against 'lost_counter' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': found map 4 (lost_counter, sec 13, off 96) for insn #77 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #4: insn #120 against 'ipv6_events' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': found map 3 (ipv6_events, sec 13, off 80) for insn #120 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #5: insn #129 against 'lost_counter' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': found map 4 (lost_counter, sec 13, off 96) for insn #129 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #6: insn #139 against 'lost_doorbell' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': found map 5 (lost_doorbell, sec 13, off 128) for insn #139 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.rel.text': relo #7: insn #146 against 'currsock' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': found map 0 (currsock, sec 13, off 0) for insn #146 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.relkprobe/tcp_v4_connect': collecting relocation for section(4) 'kprobe/tcp_v4_connect' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.relkprobe/tcp_v4_connect': relo #0: insn #8 against 'currsock' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kprobe__tcp_v4_connect': found map 0 (currsock, sec 13, off 0) for insn #8 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.relkretprobe/tcp_v4_connect': collecting relocation for section(6) 'kretprobe/tcp_v4_connect' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.relkretprobe/tcp_v4_connect': relo #0: insn #2 against '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.relkprobe/tcp_v6_connect': collecting relocation for section(8) 'kprobe/tcp_v6_connect' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.relkprobe/tcp_v6_connect': relo #0: insn #8 against 'currsock' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kprobe__tcp_v6_connect': found map 0 (currsock, sec 13, off 0) for insn #8 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.relkretprobe/tcp_v6_connect': collecting relocation for section(10) 'kretprobe/tcp_v6_connect' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.relkretprobe/tcp_v6_connect': relo #0: insn #2 against '.text' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'currsock': created successfully, fd=50 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'monitored_cgroups': created successfully, fd=51 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'ipv4_events': created successfully, fd=52 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'ipv6_events': created successfully, fd=53 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_counter': created successfully, fd=54 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: map 'lost_doorbell': created successfully, fd=55 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'kprobe/tcp_v4_connect': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: CO-RE relocating [335] struct pt_regs: found target candidate [222] struct pt_regs in [vmlinux] Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kprobe__tcp_v4_connect': relo #0: [335] struct pt_regs.di (0:14 @ offset 112) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kprobe__tcp_v4_connect': relo #0: matching candidate #0 [222] struct pt_regs.di (0:14 @ offset 112) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kprobe__tcp_v4_connect': relo #0: patched insn #0 (LDX/ST/STX) off 112 -> 112 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'kretprobe/tcp_v4_connect': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kretprobe__tcp_v4_connect': relo #0: [335] struct pt_regs.ax (0:10 @ offset 80) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kretprobe__tcp_v4_connect': relo #0: matching candidate #0 [222] struct pt_regs.ax (0:10 @ offset 80) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kretprobe__tcp_v4_connect': relo #0: patched insn #0 (LDX/ST/STX) off 80 -> 80 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec '.text': found 5 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: CO-RE relocating [13] struct sock: found target candidate [3553] struct sock in [vmlinux] Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #0: [13] struct sock.__sk_common.skc_dport (0:0:2:1:0 @ offset 12) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #0: matching candidate #0 [3553] struct sock.__sk_common.skc_dport (0:0:2:1:0 @ offset 12) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #0: patched insn #22 (ALU/ALU64) imm 12 -> 12 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #1: [13] struct sock.__sk_common.skc_rcv_saddr (0:0:0:1:1 @ offset 4) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #1: matching candidate #0 [3553] struct sock.__sk_common.skc_rcv_saddr (0:0:0:1:1 @ offset 4) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #1: patched insn #42 (ALU/ALU64) imm 4 -> 4 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #2: [13] struct sock.__sk_common.skc_daddr (0:0:0:1:0 @ offset 0) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #2: matching candidate #0 [3553] struct sock.__sk_common.skc_daddr (0:0:0:1:0 @ offset 0) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #2: patched insn #49 (ALU/ALU64) imm 0 -> 0 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #3: [13] struct sock.__sk_common.skc_v6_rcv_saddr (0:0:14 @ offset 72) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #3: matching candidate #0 [3553] struct sock.__sk_common.skc_v6_rcv_saddr (0:0:14 @ offset 72) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #3: patched insn #96 (ALU/ALU64) imm 72 -> 72 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #4: [13] struct sock.__sk_common.skc_v6_daddr (0:0:13 @ offset 56) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #4: matching candidate #0 [3553] struct sock.__sk_common.skc_v6_daddr (0:0:13 @ offset 56) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'trace_connect_return': relo #4: patched insn #103 (ALU/ALU64) imm 56 -> 56 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'kprobe/tcp_v6_connect': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kprobe__tcp_v6_connect': relo #0: [335] struct pt_regs.di (0:14 @ offset 112) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kprobe__tcp_v6_connect': relo #0: matching candidate #0 [222] struct pt_regs.di (0:14 @ offset 112) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kprobe__tcp_v6_connect': relo #0: patched insn #0 (LDX/ST/STX) off 112 -> 112 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: sec 'kretprobe/tcp_v6_connect': found 1 CO-RE relocations Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kretprobe__tcp_v6_connect': relo #0: [335] struct pt_regs.ax (0:10 @ offset 80) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kretprobe__tcp_v6_connect': relo #0: matching candidate #0 [222] struct pt_regs.ax (0:10 @ offset 80) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kretprobe__tcp_v6_connect': relo #0: patched insn #0 (LDX/ST/STX) off 80 -> 80 Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kretprobe__tcp_v4_connect': added 150 insns from sub-prog 'trace_connect_return' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kretprobe__tcp_v4_connect': insn #2 relocated, imm 2 points to subprog 'trace_connect_return' (now at 5 offset) Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kretprobe__tcp_v6_connect': added 150 insns from sub-prog 'trace_connect_return' Apr 23 19:16:31 localhost.localdomain teleport[36045]: libbpf: prog 'kretprobe__tcp_v6_connect': insn #2 relocated, imm 2 points to subprog 'trace_connect_return' (now at 5 offset) Apr 23 19:16:31 localhost.localdomain teleport[36045]: {"caller":"bpf/bpf.go:184","component":"bpf","level":"debug","message":"Started enhanced session recording with buffer sizes (command=8, disk=128, network=8) and cgroup mount path: /cgroup2. Took 479.820393ms.","timestamp":"2024-04-23T19:16:31Z"} Apr 23 19:16:31 localhost.localdomain teleport[36045]: {"caller":"sshutils/server.go:280","component":"ssh:node","level":"debug","message":"Supported ciphers: [\"aes128-gcm@openssh.com\" \"aes256-gcm@openssh.com\" \"chacha20-poly1305@openssh.com\" \"aes128-ctr\" \"aes192-ctr\" \"aes256-ctr\"].","timestamp":"2024-04-23T19:16:31Z"} Apr 23 19:16:31 localhost.localdomain teleport[36045]: {"caller":"sshutils/server.go:290","component":"ssh:node","level":"debug","message":"Supported KEX algorithms: [\"curve25519-sha256\" \"curve25519-sha256@libssh.org\" \"ecdh-sha2-nistp256\" \"ecdh-sha2-nistp384\" \"ecdh-sha2-nistp521\" \"diffie-hellman-group14-sha256\"].","timestamp":"2024-04-23T19:16:31Z"} ```

Users who are using Rhel8 could benefit from enhanced session recording without having to upgrade their fleet to use a different kernel.

If a workaround exists, please include it.

There is not a good workaround since it requires a code change.

jakule commented 4 months ago

AFAIK eBPF modules are verified on load, so if the program can run will will be loaded, otherwise it will be rejected by the kernel. Base on that I'd change our logic from: Check the kernel > 5.8 and prevent loading the module to Load the module and if we fail to load return "kernel 5.8 is required" error.

vapopov commented 1 week ago

backported to v16, v15, v14