Skip to content

This issue was moved to a discussion.

You can continue the conversation there. Go to discussion →

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

magic_write: Missing complicated definitions values in BPF programs #1506

Closed
AlonZivony opened this issue Feb 23, 2022 · 2 comments
Closed
Assignees

Comments

@AlonZivony
Copy link
Contributor

In CO-RE there is no access to definitions in the kernel, so we need to calculate them ourselves.
Currently we created the missing_definitions.h file to define mandatory definitions.
However, this won't work for definitions which depends on kconfig values, or which are translated to globals which we don't have access to either in CO-RE.
There should be a way to calculate these complicated values for the BPF programs to use.

@AlonZivony
Copy link
Contributor Author

I am wondering how to implement this one.
Most of the consts could be defined in the missing_definitions.h file.
However, some values depend on BPF helpers and globals, so they cannot be defined in compilation time.

My solution was to create a map between const key to its value.
However, this solution is much lest efficient than using defined value. So, if we make this the normal way to use consts we will harm the performance.
The other option is to create 2 APIs to get consts depending on its value complication (normal consts will be defined, and complicated accessed using map). This makes the code less accessible to new users.

WDYT @rafaeldtinoco?

@rafaeldtinoco rafaeldtinoco changed the title Missing complicated definitions values in BPF programs magic_write: Missing complicated definitions values in BPF programs Apr 6, 2022
@yanivagman
Copy link
Collaborator

This is more of implementation discussion than an issue in tracee.
Converting to discussion.

@aquasecurity aquasecurity locked and limited conversation to collaborators Jan 30, 2023
@yanivagman yanivagman converted this issue into discussion #2653 Jan 30, 2023

This issue was moved to a discussion.

You can continue the conversation there. Go to discussion →

Projects
None yet
Development

No branches or pull requests

2 participants