search

microsoft / ebpf-for-windows

eBPF implementation that runs on top of Windows
MIT License
2.88k stars 225 forks source link

Extension manifest files for declaring program information #3046

Open dahavey opened 11 months ago

dahavey commented 11 months ago

@mtfriesen - please work on the design for this

Discussed in https://github.com/microsoft/ebpf-for-windows/discussions/3044

Originally posted by **shankarseal** November 13, 2023 Currently eBPF extension drivers have to ship an user mode tool to populate the eBPF store with program information. Instead, can extension developers publish manifest files that a central program info export program processes to populate the store on behalf of the extensions?
saxena-anurag commented 2 months ago

Removing triage label to re-triage this issue in next meeting. I think we should try to fix this sooner than later. Registry based approach has gone multiple iterations and has also caused regressions more than once due to HKLM / HKCU.

mtfriesen commented 1 week ago

@shankarseal, @saxena-anurag, @Alan-Jowett, now that eBPF has supported multiple CPU architectures, requiring binary builds that match the host platform (to allow local eBPF verification) has become increasingly awkward. It would significantly ease developer pain if hook attributes, program attributes, etc. could be specified in a platform-agnostic file format.

saxena-anurag commented 1 week ago

@shankarseal, @saxena-anurag, @Alan-Jowett, now that eBPF has supported multiple CPU architectures, requiring binary builds that match the host platform (to allow local eBPF verification) has become increasingly awkward. It would significantly ease developer pain if hook attributes, program attributes, etc. could be specified in a platform-agnostic file format.

Agree. I was thinking we can maybe switch to json files, with these files being placed in well-known place like ProgramData\ebpf. Whenever any extension is installed / uninstalled, it can add /remove config file for its program and attach types to the same location.

Whenever ebpfapi.dll is initialized, it will parse all the files present in ProgramData\ebpf, and populate the program info, etc.

There are a few other scenarios which we will also need to ensure that they work -- for example, using a nuget package to build ebpf programs.

mtfriesen commented 1 week ago

This sounds great. For nuget/devbuild scenarios, it would also be useful if additional search directories could be specified.