cgproxy/execsnoop-libbpf

Resource

• libbpf
• libbpf-tools examples use libbpf
• bpftool to generate skeleton and dump btf

Prons

• BPF CO-RE (Compile Once – Run Everywhere)
• small memory usage

Cons

• vmlinux.hdoes not contain #define etc. And often causes confilct with other headers to cause redifinition error
• comment in code for different types is gone
• need kernel built with CONFIG_DEBUG_INFO_BTF=y, while ubuntu 20.04 still not

Build

• see makefile