fix(bpf): fix rss_stat being an array and not a struct #78
Conversation
This patch was extracted from this upstream commit: falcosecurity/libs@6ff3167 Because we are not backporting the full feature added by the original PR, this is a smaller patch.
This reverts commit 47b558e.
Molter73
force-pushed
the
mauro/backport-rss-stat-fix
branch
from
c6f636a to
7e49041
Compare
Hey folks! Sorry for the random comment, but as if it were a sign of destiny, this PR appeared on my GitHub homepage 😂. If i can ask it, are you planning to deprecate the legacy eBPF probe in StackRox or are you talking about a future deprecation in upstream libs? I ask this just to understand the current adoption of the legacy ebpf probe |
Hey Andrea! We are deprecating the eBPF probe for StackRox, we've already stopped using the kernel module a couple releases ago and we hope we can go full CORE BPF in the near future. We don't have any plans to push for upstream deprecation of any drivers though. |
|
Thank you for the quick answer @Molter73!
❤️ 🤞 |
This error was originally fixed upstream by adding a full check at source configuration time, this is incompatible with our way of building drivers, so we are skipping that and directly making the check we need explicit. It would be a big deal, but with eBPF deprecation and full removal in the horizon, I think this is an acceptable tradeoff.