On Mon, Nov 19, 2018 at 03:29:07PM +0000, Peter Parkanyi wrote: > Hi, > > At LPC I raised the observation that currently it doesn't seem > feasible to insert a BPF probe from within a container that sees > events happening outside of the container, while it is possible to > insert a kernel module. > > It was suggested that this is not the case, and things should just work. > I wanted to get a minimal reproduction of what I've seen in Docker > containers, so if somebody could take a look, I'd appreciate any > comments on the right way of doing this. > > The kprobe in question: > https://github.com/redsift/ingraind/blob/master/bpf/file.c
I suspect there is something in the bpf prog that makes it skip in-chroot events. Can you add bpf_trace_printk-s throught the code to see what's wrong? Like does your test can even create the test file? As far as I can see on the kernel side kprobe will be firing.