Giters

cilium / ebpf

ebpf-go is a pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.

Home Page:https://ebpf-go.dev

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

program: make it harder to attach Kretprobe via link.Kprobe and vice versa

lmb opened this issue · comments

commented

Kprobe and Kretprobe both have the same program type, so the library can't guard against using the wrong attachment hooks (see #1490 (comment)). Figuring out whether a program is a kretprobe currently involves doing a string match on ProgramSpec.SectionName. It would be nice to do one at least of the following.

  • Make it so that link.Kprobe returns an error when passed a Kretprobe program. This requires either figuring out whether a program is a Kretprobe (hard, because programs can be loaded from a pin) or communicating it to link.Kprobe somehow. Maybe we can shoehorn this into ProgramSpec.AttachTo somehow, which is often passed directly to link.Kprobe etc. But does this create other breakage?
  • Make it easier to figure out if a ProgramSpec is a Kretprobe somehow (though a method on ProgramSpec seems really ugly?)
  • Add an example which shows how to attach kprobe / kretprobe based on the SectionName.