On Mon, Nov 19, 2018 at 03:29:07PM +0000, Peter Parkanyi wrote:
> Hi,
> 
> At LPC I raised the observation that currently it doesn't seem
> feasible to insert a BPF probe from within a container that sees
> events happening outside of the container, while it is possible to
> insert a kernel module.
> 
> It was suggested that this is not the case, and things should just work.
> I wanted to get a minimal reproduction of what I've seen in Docker
> containers, so if somebody could take a look, I'd appreciate any
> comments on the right way of doing this.
> 
> The kprobe in question:
> https://github.com/redsift/ingraind/blob/master/bpf/file.c

I suspect there is something in the bpf prog that makes it skip in-chroot
events.
Can you add bpf_trace_printk-s throught the code to see what's wrong?
Like does your test can even create the test file?
As far as I can see on the kernel side kprobe will be firing.

Reply via email to