4 ms·

You can access memory in ebpf.

• insanitybit 3y ago
  I don't think that's been true historically. You can access maps that you provide, but dereferencing userland pointers (like path names passed into an 'open' call) have not been available. Or has that changed recently?
  • lcvw 3y ago
    I don’t know about the past, but you can absolutely dereference userspace memory in ebpf.
  • Bognar 3y ago
    https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md#10-bpf_probe_read_user https://github.com/iovisor/bcc/blob/master/docs/reference_gu...