Documentation ¶
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func AddSyscallPrefix ¶
AddSyscallPrefix detects if the symbol is already prefixed with arch specific prefix in the form of "__x64_" or "__arm64_", and if not, adds it based on provided arch.
Note that cilium/ebpf, retries to attach to an arch specific version of the symbol after a failure thus making possible to attach to "sys_listen" which will fail and retry with the corrected "__arm64_sys_listen" if you are running on arm64. See https://github.com/cilium/ebpf/pull/304. However, this causes Tetragon users to believe that two symbols exist (following the same example) "__arm64_sys_listen" and "sys_listen", which results in differents events. Because we actually know if a call is a syscall, we can pre-format the symbol directly here to allow the user to specify the "sys_listen" version while only registering the real symbol "__arm64_sys_listen".
func AddSyscallPrefixTestHelper ¶
AddSyscallPrefixTestHelper is like AddSyscallPrefix but calls t.Fatal if the arch is unsupported or if the symbol has already a prefix that doesn't correspond to the running arch.
It's a helper supposed to be used only in testing code.
func CutSyscallPrefix ¶ added in v0.10.0
CutSyscallPrefix removes a potential arch specific prefix from the symbol. If a prefix was removed, it returns the corresponding arch as a first argument.
func HasSyscallPrefix ¶ added in v1.1.0
Types ¶
This section is empty.