thought-machine / falco-probes

Automated build and mirror of eBPF kernel probes for use as a driver with the Falco runtime security agent (https://falco.org/)
Apache License 2.0
16 stars 4 forks source link

Verification that built probes work #21

Open VJftw opened 3 years ago

VJftw commented 3 years ago

In order to provide consumers assurance that the eBPF probes built by this project actually work with their associated kernels, we should implement some form of tests that prove their compatibility.

This implementation should support operating systems with and without package managers (i.e. amazonlinux2 vs cos)

We're open to ideas on this!

To get the ball rolling, some example ideas from the top of my head: