3 ms·

I don't think that's been true historically. You can access maps that you provide, but dereferencing userland pointers (like path names passed into an 'open' ca

I don't think that's been true historically. You can access maps that you provide, but dereferencing userland pointers (like path names passed into an 'open' call) have not been available. Or has that changed recently?

lcvw 3y ago
I don’t know about the past, but you can absolutely dereference userspace memory in ebpf.
Bognar 3y ago
https://github.com/iovisor/bcc/blob/master/docs/reference_guide.md#10-bpf_probe_read_user https://github.com/iovisor/bcc/blob/master/docs/reference_gu...