3 ms·
From https://news.ycombinator.com/item?id=37442312 https://news.ycombinator.com/item?id=37442312 re why not ptrace for tracing all exec() syscalls: > The Falco
by westurner 2y ago
From https://news.ycombinator.com/item?id=37442312 https://news.ycombinator.com/item?id=37442312 re why not ptrace for tracing all exec() syscalls:
> The Falco docs list 3 syscall event drivers: Kernel module, Classic eBPF probe, and Modern eBPF probe: https://falco.org/docs/event-sources/kernel/ https://falco.org/docs/event-sources/kernel/