kubearmor / libbpf Goto Github PK

The current implementation depends entirely on libbpf.BPFMap.GetModule(). To work around this problem, it would be necessary to keep a KABPFObject reference inside KABPFMap as well.

There are some types of links that will be needed soon :

• Tracepoint
• Raw Tracepoint
• LSM

We need to support detach/unloading of specific ebpf programs links without to close the object (and consequently its other relations).

KABPFMap.LookupElement() hasn't err validation.

E.g.:

The methods must to return nil pointers when error and only fill the structures when err is nil. We cannot just rely on the return of the underlying library.

To initialize ring buffer we will need a wrapper function. This could be something like InitRingBuf(), used by libbpfgo (https://github.com/aquasecurity/libbpfgo/blob/main/selftest/ringbuffers/main.go#L60)

Implement of the following wrapper functions is currently required to attach any ebpf program:

• getprogram()
• attachkprobe()
• traceprint()

How to guarantee that the consumer will easily (and correctly) read from and write data to maps?

One needs to satisfy an interface (KABPFMapElement) to make use of the element management methods. Thus, the kubearmor/libbpf could easily get the right Key and Value pointers. It would also enable updating Value automatically on a successful LookupElement() call.