top | item 46089989

(no title)

mroche | 3 months ago

Cool project! As a more advanced form, I think it should be possible to get all this information via eBPF rather than ss output and scraping /proc.

Food for thought!

discuss

order

oneshtein|3 months ago

eBPF doesn't work on locked down kernels (stock kernels in Secure Boot mode).

mroche|3 months ago

eBPF is restricted when booted in a SB environment, but it's not nonfunctional. The default config puts the kernel into "integrity" mode of Kernel Lockdown, which reduces scope of access and enforces read-only usage.

Whether or not the specific functions needed to replicate this tool are impacted is beyond my knowledge.

grigio|3 months ago

I think this is a great point, eBPF is cool but probably less popular than ss