Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

[8.16](backport #41297) [auditbeat] Allow memfd_create(2) in seccomp for add_session_metadata… #41316

Open
wants to merge 1 commit into
base: 8.16
Choose a base branch
from
Open

[8.16](backport #41297) [auditbeat] Allow memfd_create(2) in seccomp for add_session_metadata… #41316

wants to merge 1 commit into from

Commits on Oct 18, 2024

  1. [auditbeat] Allow memfd_create(2) in seccomp for add_session_metadata… 

    …@ebpf (#41297)

Quark was falling back into kprobe since ebpf would fail with EPERM at
memfd_create(2).

```
$ strace -f auditbeat ....
[pid  2917] memfd_create("libbpf-placeholder-fd", MFD_CLOEXEC) = -1 EPERM (Operation not permitted)
```

With this my test case where kprobe is disabled now uses ebpf when I select
backend "auto", before it was falling back to procfsprovider.

(cherry picked from commit 6766cfa)
    @haesbaert @mergify
    haesbaert authored and mergify[bot] committed Oct 18, 2024
    Configuration menu
    Copy the full SHA
    eb1704d View commit details
    Browse the repository at this point in the history