Skip to content

eBPF

➡ for grabbing bpftool

When sudo apt install bpftool doesn't work

1
2
3
4
5
6
7
# For latest build follow below link
# https://github.com/libbpf/bpftool/releases

wget https://github.com/libbpf/bpftool/releases/download/v7.5.0/bpftool-v7.5.0-amd64.tar.gz
tar xf bpftool*
chmod +x ./bpftool
./bpftool

➡ for loading program

sudo mount -t bpf bpffs /sys/fs/bpf
sudo bpftool prog load ./sample.o /sys/fs/bpf/sample

➡ for bpf_printk() logs

1
2
3
4
5
6
7
8
9
# to clear previous logs
sudo echo > /sys/kernel/debug/tracing/trace

# print logs
sudo cat /sys/kernel/debug/tracing/trace_pipe

# for k8s-debug pod
echo > /host/sys/kernel/debug/tracing/trace
cat /host/sys/kernel/debug/tracing/trace_pipe

➡ for ebpf-lsm & kprobe-override status

1
2
3
4
5
# for ebpf-lsm
cat /sys/kernel/security/lsm

# for override
cat /boot/config-`uname -r` | grep CONFIG_BPF_KPROBE_OVERRIDE