3 ms·

> psc uses eBPF iterators to read process and file descriptor information directly from kernel data structures. This bypasses the /proc filesystem entirely, pro

by apopapo 9mo ago

> psc uses eBPF iterators to read process and file descriptor information directly from kernel data structures. This bypasses the /proc filesystem entirely, providing visibility that cannot be subverted by userland rootkits or LD_PRELOAD tricks. Is there a trade off here?

tempay 9mo ago
It requires root
- mgaunard 9mo ago
  Running eBPF programs doesn't strictly require root.
  - cpuguy83 9mo ago
    It requires cap_bpf which is considered a high privileged capability. So yes, it requires root in the sense of what people mean by root.
    - mgaunard 9mo ago
      You can also enable unpriviledged ebpf.
mgaunard 9mo ago
I found this justification dubious. To me the main reason to use eBPF is that it gives more information and is lower overhead.