- tracing execve calls
- added lsm hooks with applying hooks preventing the sys call
- Download git version of
libbpf-rsby git clone - Move to the directory of
libbpf-rs. cargo install --path libbpf-rs/libbpf-cargocargo new bpf-rs- Adding entries to toml file
[dependencies]
anyhow = "1.0"
libbpf-rs = {path = "../libbpf-rs/libbpf-rs"}
libc = "0.2"makesudo <exec-file>- to see the trace_pipe
sudo cat /sys/kernel/tracing/trace_pipe