dtrace

Prompt 1C: Create a Go package named dbpftrace with a README and docs, then create a cli utility named dbpftrace to: parse pid and descendents' fs syscall events (like bpftrace) using libbpfgo and godtrace Use either (cilium/ebpf or libbpfgo or gobpf) or (godtrace or (CGO or FFI) bindings to libdtrace) depending on which OS, by default cilium/ebpf: https://github.com/cilium/ebpf aquasecurity/libbpfgo https://github.com/aquasecurity/libbpfgo iovisor/gobpf w/ bcc: https://github.com/iovisor/gobpf chzyer/godtrace: https://github.com/chzyer/godtrace oracle/dtrace-utils/tree/devel/libdtrace: https://github.com/oracle/dtrace-utils/tree/devel/libdtrace From https://news.ycombinator.com/item?id=45755142 re eBPF for WAF: > awesome-ebpf > Kernel docs, examples, Go libraries: https://github.com/zoidyzoidzoid/awesome-ebpf#go-libraries : >> Go li

Was referring to https://github.com/oracle/dtrace-utils/tree/2.0-branch-dev Will DTrace (built on ebpf.io) access these memfd_secret regions?

Hi, Yes, it's GPL (and we got rid of the separate kernel module). The utils portion is UPL. It's available with new kernels (including 5.0) on github as well. https://github.com/oracle/dtrace-utils https://github.com/oracle/libdtrace-ctf https://github.com/ezannoni/dtrace-linux-kernel We are working on a Fedora version of the kernel patches. We are also discussing with the BPF team (on netdev) how to provide DTrace functionality integrated with the Linux Kernel.