Changing bpf prog load, map create event names to be more descriptive #667
Conversation
Signed-off-by: Natalia Reka Ivanko <[email protected]>
| @@ -268,7 +268,7 @@ func (p *CompactEncoder) EventToString(response *tetragon.GetEventsResponse) (st | |||
| } | |||
| return CapTrailorPrinter(fmt.Sprintf("%s %s %s bytes %d", event, processInfo, args, bytes), caps), nil | |||
| case "bpf_check": | |||
| event := p.Colorer.Blue.Sprintf("🐝 %-7s", "bpf_check") | |||
| event := p.Colorer.Blue.Sprintf("🐝 %-7s", "bpf_load") | |||
There was a problem hiding this comment.
bpf_check is related to the bpf verifier so the description is correct, it could be even changed to bpf_verifier_check for users.
And that one could fail at the verifier so strictly speaking the load may not happen, I suggest to have another call hook after the bpf_check to sure that the load did happen.
How this is triggered do we have a CRD for it?
There was a problem hiding this comment.
The issue here is the use case is to have a hook when bpf programs are loaded not so much about the verifier. So for users bpf_load makes sense IMO and is more intuitive.
There was a problem hiding this comment.
Alright, so let's improve it with another patch something like at bpf_audit_prog(prog, audit_load || unload); that could better assert things really happened, would this be ok?
There was a problem hiding this comment.
nah seems it can be inlined, will see later.
| @@ -268,7 +268,7 @@ func (p *CompactEncoder) EventToString(response *tetragon.GetEventsResponse) (st | |||
| } | |||
| return CapTrailorPrinter(fmt.Sprintf("%s %s %s bytes %d", event, processInfo, args, bytes), caps), nil | |||
| case "bpf_check": | |||
| event := p.Colorer.Blue.Sprintf("🐝 %-7s", "bpf_check") | |||
| event := p.Colorer.Blue.Sprintf("🐝 %-7s", "bpf_load") | |||
There was a problem hiding this comment.
Alright, so let's improve it with another patch something like at bpf_audit_prog(prog, audit_load || unload); that could better assert things really happened, would this be ok?
Signed-off-by: Natalia Reka Ivanko [email protected]