luna/enodia-sentinal
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

Harden BCC syscall probe attachment

Browse source
This commit is contained in:
Luna 2026-07-08 17:04:45 -07:00
parent 2d23e8b878
commit 93ac47dd82
2 changed files with 44 additions and 6 deletions
Download patch file Download diff file Expand all files Collapse all files

5
enodia_sentinel/events/bcc_syscall_source.py
View file

@ -4,7 +4,7 @@ from __future__ import annotations
from collections.abc import Callable
from .bcc_source import _decode, available
from .bcc_source import _decode, attach_kprobe_candidates, available
from .syscall_event import SyscallEvent
_BPF_PROGRAM = r"""
@ -180,8 +180,7 @@ class BccSyscallSource:
attached = 0
for syscall, fn_name in _PROBES.items():
try:
event = self._bpf.get_syscall_fnname(syscall)
self._bpf.attach_kprobe(event=event, fn_name=fn_name)
attach_kprobe_candidates(self._bpf, syscall, fn_name)
attached += 1
except Exception as exc:
self.attach_errors.append(f"{syscall}: {exc!r}")