### PerfBuffer Start Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Starts the PerfBuffer, enabling data collection. ```go func (pb *PerfBuffer) Start(){ } ``` -------------------------------- ### RingBuffer Start Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Starts the RingBuffer, enabling data collection. ```go func (rb *RingBuffer) Start(){ } ``` -------------------------------- ### Get Byte Order - Go Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/selftest/common Returns the byte order of the system. No specific setup is required. ```go func ByteOrder() binary.ByteOrder ``` -------------------------------- ### PerfBuffer Start Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Starts the performance buffer, enabling it to receive events. ```go func (pb *PerfBuffer) Start() ``` -------------------------------- ### RingBuffer Start Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Starts the ring buffer, enabling it to receive events. ```go func (rb *RingBuffer) Start() ``` -------------------------------- ### TracePipeListen Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Starts listening on the trace pipe. Returns an error if the operation failed. ```APIDOC ## TracePipeListen ### Description Starts listening on the trace pipe. ### Returns - `error`: An error if listening failed, nil otherwise. ``` -------------------------------- ### UnameMachine Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Gets the version string of the host's architecture. ```APIDOC ## func UnameMachine ### Description UnameMachine gets the version string of host's architecture. ### Signature ```go func UnameMachine() (string, error) ``` ``` -------------------------------- ### UnameRelease Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Gets the version string of the current running kernel. ```APIDOC ## func UnameRelease ### Description UnameRelease gets the version string of the current running kernel. ### Signature ```go func UnameRelease() (string, error) ``` ``` -------------------------------- ### Get Host Architecture Version Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves the architecture version string of the host system. Returns the version string and an error if retrieval fails. ```go func UnameMachine() (string, error) ``` -------------------------------- ### Get Kernel Configuration File Path Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves the path of the kconfig file that was selected during the initialization of KernelConfig. ```go func (k *KernelConfig) GetKernelConfigFilePath() string ``` -------------------------------- ### Get OS Information Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers GetOSInfo creates an OSInfo object and runs discoverOSDistro() during its creation. This function retrieves comprehensive OS details. ```go func GetOSInfo() (*OSInfo, error) ``` -------------------------------- ### Initialize and Start Ring Buffer Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Initializes a ring buffer for event communication from BPF programs to userspace. Events are consumed from the provided channel. Adjust buffSize as needed. ```go // ring buffer rb, _ := bpfModule.InitRingBuffer("events", eventsChannel, buffSize) rb.Start() e := <-eventsChannel ``` -------------------------------- ### Get Full Kernel Version String - Go Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/selftest/common Retrieves the full kernel version string from /proc/version. Returns 'unknown' if the file cannot be read. ```go func GetKernelVersion() string ``` -------------------------------- ### Get OS Release File Path Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Returns the path to the os-release file being used. This path may vary depending on environment variables and is not always /etc/os-release. ```go func (btfi *OSInfo) GetOSReleaseFilePath() string ``` -------------------------------- ### Get Kernel Release Version Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves the version string of the currently running kernel. Returns the release string and an error if retrieval fails. ```go func UnameRelease() (string, error) ``` -------------------------------- ### Get Kernel Symbol Architecture - Go Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/selftest/common Returns the architecture of the kernel symbols. No arguments are needed. ```go func KSymArch() string ``` -------------------------------- ### RingBuffer Methods Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Methods available for the RingBuffer type, including Close, Start, and Stop. ```APIDOC ## RingBuffer ### Methods #### Close ```go func (rb *RingBuffer) Close() ``` #### Start ```go func (rb *RingBuffer) Start() ``` #### Stop ```go func (rb *RingBuffer) Stop() ``` ``` -------------------------------- ### Get Kernel Release String - Go Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/selftest/common Extracts the kernel release version string from /proc/version. Returns 'unknown' if parsing fails. ```go func GetKernelRelease() string ``` -------------------------------- ### PerfBuffer Methods Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Methods available for the PerfBuffer type, including Close, Start, and Stop. ```APIDOC ## PerfBuffer ### Methods #### Close ```go func (pb *PerfBuffer) Close() ``` #### Start ```go func (pb *PerfBuffer) Start() ``` #### Stop ```go func (pb *PerfBuffer) Stop() ``` ``` -------------------------------- ### LoadKernelConfig Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers LoadKernelConfig re-reads the kconfig file. This is useful after modifying kernel configurations, for example, after calling AddCustomKernelConfig. ```APIDOC ## LoadKernelConfig ### Description LoadKernelConfig will (re)read kconfig file (likely after AddCustomKernelConfig was called). ### Method func (*KernelConfig) LoadKernelConfig() error ``` -------------------------------- ### Parse Get Socket Option Function Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Parses the raw uint64 value of the 'optname' argument for the getsockopt syscall. Refer to man pages for detailed information. ```go func ParseGetSocketOption(rawValue uint64) (SocketOptionArgument, error) ``` -------------------------------- ### OSInfo Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers The OSInfo struct contains operating system-specific information, useful for conditional logic in examples or system interactions. ```APIDOC #### type OSInfo ¶ ```go type OSInfo struct { // contains filtered or unexported fields } ``` OSInfo object contains all OS relevant information. OSRelease is relevant to examples such as: 1) OSInfo.OSReleaseInfo[helpers.OS_KERNEL_RELEASE] => will provide $(uname -r) string 2) if OSInfo.GetReleaseID() == helpers.UBUNTU => {} will allow running code in specific distribution ``` -------------------------------- ### Initialize and Load BPF Module Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Initializes a BPF module from an object file and loads the BPF object. Ensure the bpfObjectPath is correctly set. ```go // initializing import bpf "github.com/aquasecurity/libbpfgo" ... bpfModule := bpf.NewModuleFromFile(bpfObjectPath) bpfModule.BPFLoadObject() ``` -------------------------------- ### Module InitRingBuf Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Initializes a ring buffer for a given map. Requires map name and a channel for events. ```go func (m *Module) InitRingBuf(mapName string, eventsChan chan []byte) (*RingBuffer, error) ``` -------------------------------- ### Module BPFLoadObject Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Loads the BPF object into the kernel. This should be called after creating a module. ```go func (m *Module) BPFLoadObject() error ``` -------------------------------- ### Initialize Kernel Symbol Map Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Initiates the kernel symbol map by parsing /proc/kallsyms. This is useful for looking up kernel symbols by address or name. ```go func NewKernelSymbolsMap() (*KernelSymbolTable, error) ``` -------------------------------- ### TcHook GetInterfaceIndex Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Gets the network interface index associated with the TcHook. ```go func (hook *TcHook) GetInterfaceIndex() int ``` -------------------------------- ### Module InitPerfBuf Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Initializes a performance buffer (perf buffer) for a given map. Requires map name, channels for events and lost events, and page count. ```go func (m *Module) InitPerfBuf(mapName string, eventsChan chan []byte, lostChan chan uint64, pageCnt int) (*PerfBuffer, error) ``` -------------------------------- ### BPFProg AttachKretprobe Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to a kernel kretprobe (return probe). Requires the kprobe name. ```go func (p *BPFProg) AttachKretprobe(kp string) (*BPFLink, error) ``` -------------------------------- ### Get Raw Value of InodeModeArgument Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves the underlying unsigned 64-bit integer value of an InodeModeArgument. ```go func (mode InodeModeArgument) Value() uint64 ``` -------------------------------- ### Initialize KernelConfig Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Initializes a new external KernelConfig object. Returns a pointer to the initialized object and an error if initialization fails. ```go func InitKernelConfig() (*KernelConfig, error) ``` -------------------------------- ### BPFProg AttachKprobeLegacy Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to a kernel kprobe using a legacy method. Requires the kprobe name. ```go func (p *BPFProg) AttachKprobeLegacy(kp string) (*BPFLink, error) ``` -------------------------------- ### PtraceRequestArgument Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Represents an argument for ptrace requests, providing methods to get its string representation and underlying value. ```APIDOC ## PtraceRequestArgument ### Description Provides methods to interact with ptrace request arguments. ### Methods - `String() string`: Returns the string representation of the argument. - `Value() uint64`: Returns the uint64 value of the argument. ``` -------------------------------- ### BPFProg AttachKretprobeLegacy Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to a kernel kretprobe using a legacy method. Requires the kprobe name. ```go func (p *BPFProg) AttachKretprobeLegacy(kp string) (*BPFLink, error) ``` -------------------------------- ### BPFProg AttachKprobe Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to a kernel kprobe. Requires the kprobe name as input. ```go func (p *BPFProg) AttachKprobe(kp string) (*BPFLink, error) ``` -------------------------------- ### Module GetProgram Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Retrieves a BPF program by its name from the loaded module. ```go func (m *Module) GetProgram(progName string) (*BPFProg, error) ``` -------------------------------- ### Get uint64 value of MmapProtArgument Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Returns the uint64 value of an MmapProtArgument. This can be used when interacting with lower-level system calls. ```go func (p MmapProtArgument) Value() uint64 ``` -------------------------------- ### Get uint64 value of MmapFlagArgument Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Returns the uint64 value of an MmapFlagArgument. This can be used when interacting with lower-level system calls. ```go func (mf MmapFlagArgument) Value() uint64 ``` -------------------------------- ### NewModuleFromFile Function Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Creates a new BPF module from a BPF object file. Requires the path to the object file. ```go func NewModuleFromFile(bpfObjFile string) (*Module, error) ``` -------------------------------- ### Get Kernel Symbol by Name Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves a kernel symbol by its name and owner module. Requires a pre-initialized KernelSymbolTable. ```go func (k *KernelSymbolTable) GetSymbolByName(owner string, name string) (*KernelSymbol, error) ``` -------------------------------- ### Compare Kernel Release Strings Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Compares two kernel release strings (e.g., from `uname -r`) to determine their version relationship. Handles potential errors from malformed strings. ```go func CompareKernelRelease(base, given string) (KernelVersionComparison, error) ``` -------------------------------- ### BPFProg AttachURetprobe Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to a user-space return probe (uretprobe). Requires PID, path, and offset. ```go func (p *BPFProg) AttachURetprobe(pid int, path string, offset uint32) (*BPFLink, error) ``` -------------------------------- ### Get Kernel Symbol by Address Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves a kernel symbol based on its memory address. Requires a pre-initialized KernelSymbolTable. ```go func (k *KernelSymbolTable) GetSymbolByAddr(addr uint64) (*KernelSymbol, error) ``` -------------------------------- ### InitKernelConfig Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Initializes a new KernelConfig object. Returns a pointer to the KernelConfig and an error if initialization failed. ```APIDOC ## InitKernelConfig ### Description Initializes and returns a new KernelConfig object. ### Returns - `*KernelConfig`: A pointer to the initialized KernelConfig. - `error`: An error if initialization failed, nil otherwise. ``` -------------------------------- ### Get Current Lockdown Mode Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves the current Linux kernel lockdown mode. Returns an error if the mode cannot be determined. ```go func Lockdown() (LockdownMode, error) ``` -------------------------------- ### Module Creation Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Functions for creating a new BPF Module from buffer or file. ```APIDOC ## Module Creation ### NewModuleFromBuffer #### Description Creates a new BPF Module from a byte buffer. #### Signature ```go func NewModuleFromBuffer(bpfObjBuff []byte, bpfObjName string) (*Module, error) ``` ### NewModuleFromFile #### Description Creates a new BPF Module from a BPF object file. #### Signature ```go func NewModuleFromFile(bpfObjFile string) (*Module, error) ``` ``` -------------------------------- ### SocketTypeArgument Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Represents a socket type argument, providing parsing from raw values and methods to get string and uint64 representations. ```APIDOC ## SocketTypeArgument ### Description Defines and handles socket type arguments. ### Functions - `ParseSocketType(rawValue uint64) (SocketTypeArgument, error)`: Parses a raw uint64 value into a SocketTypeArgument. ### Methods - `String() string`: Returns the string representation of the socket type. - `Value() uint64`: Returns the uint64 value of the socket type. ``` -------------------------------- ### SocketTypeArgument.Value Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Returns the underlying `uint64` value of the `SocketTypeArgument`. This method is used to get the raw numerical representation of the socket type or flags. ```APIDOC ## SocketTypeArgument.Value ### Description Returns the underlying `uint64` value of the `SocketTypeArgument`. ### Function Signature ```go func (s SocketTypeArgument) Value() uint64 ``` ### Parameters None ### Request Example None ### Response #### Success Response (200) - **uint64** - The raw `uint64` value of the socket type. ``` -------------------------------- ### Module Creation Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Functions for creating a new BPF module from a buffer or a file. ```APIDOC ## NewModuleFromBuffer ### Description Creates a new BPF module from a byte buffer containing BPF object data. ### Method `NewModuleFromBuffer(bpfObjBuff []byte, bpfObjName string) (*Module, error)` ## NewModuleFromFile ### Description Creates a new BPF module from a BPF object file. ### Method `NewModuleFromFile(bpfObjFile string) (*Module, error)` ``` -------------------------------- ### GetOSInfo Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves OS-specific information by creating an OSInfo object and running discoverOSDistro. ```APIDOC #### func GetOSInfo ¶ ```go func GetOSInfo() (*OSInfo, error) ``` GetOSInfo creates a OSInfo object and runs discoverOSDistro() on its creation ``` -------------------------------- ### Get Kernel Configuration Option Value (BUILTIN/MODULE) Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves the KernelConfigOptionValue for a given KernelConfigOption, specifically when the option is marked as BUILTIN or MODULE. ```go func (k *KernelConfig) GetValue(option KernelConfigOption) KernelConfigOptionValue ``` -------------------------------- ### BPFProg AttachUprobe Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to a user-space probe (uprobe). Requires PID, path, and offset. ```go func (p *BPFProg) AttachUprobe(pid int, path string, offset uint32) (*BPFLink, error) ``` -------------------------------- ### SocketOptionArgument Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Represents socket option arguments, with functions to parse for getting and setting options, and methods for string and uint64 value retrieval. ```APIDOC ## SocketOptionArgument ### Description Manages socket option arguments for both getting and setting operations. ### Functions - `ParseGetSocketOption(rawValue uint64) (SocketOptionArgument, error)`: Parses a raw uint64 value for getting a socket option. - `ParseSetSocketOption(rawValue uint64) (SocketOptionArgument, error)`: Parses a raw uint64 value for setting a socket option. ### Methods - `String() string`: Returns the string representation of the socket option. - `Value() uint64`: Returns the uint64 value of the socket option. ``` -------------------------------- ### Get Cgroup V2 Root Directory - Go Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/selftest/common Retrieves the root directory of the cgroupv2 filesystem. Returns an error if the directory cannot be determined. ```go func GetCgroupV2RootDir() (string, error) ``` -------------------------------- ### Module Methods Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Methods for interacting with a loaded BPF module, including loading, closing, and retrieving maps and programs. ```APIDOC ## Module.BPFLoadObject ### Description Loads the BPF object into the kernel. ### Method `BPFLoadObject() error` ## Module.Close ### Description Closes the BPF module and releases associated resources. ### Method `Close()` ## Module.GetMap ### Description Retrieves a BPF map by its name from the module. ### Method `GetMap(mapName string) (*BPFMap, error)` ## Module.GetProgram ### Description Retrieves a BPF program by its name from the module. ### Method `GetProgram(progName string) (*BPFProg, error)` ## Module.InitPerfBuf ### Description Initializes a performance buffer for the specified map. ### Method `InitPerfBuf(mapName string, eventsChan chan []byte, lostChan chan uint64, pageCnt int) (*PerfBuffer, error)` ## Module.InitRingBuf ### Description Initializes a ring buffer for the specified map. ### Method `InitRingBuf(mapName string, eventsChan chan []byte) (*RingBuffer, error)` ## Module.TcHookInit ### Description Initializes a TC hook for the module. ### Method `TcHookInit() *TcHook` ``` -------------------------------- ### Get Kernel Configuration Option Value as String Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves the KernelConfigOptionValue for a given KernelConfigOption as a string. Returns an error if the value cannot be represented as a string. ```go func (k *KernelConfig) GetValueString(option KernelConfigOption) (string, error) ``` -------------------------------- ### InitKernelConfig Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Initializes an external KernelConfig object for managing kernel configuration options. ```APIDOC ## InitKernelConfig ### Description Initializes an external KernelConfig object for managing kernel configuration options. ### Function Signature ```go func InitKernelConfig() (*KernelConfig, error) ``` ### Parameters None ### Response #### Success Response (200) - **KernelConfig**: A pointer to the initialized KernelConfig object. - **error**: An error if initialization fails. ``` -------------------------------- ### BPFProg GetFd Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Returns the file descriptor of the BPF program. ```go func (p *BPFProg) GetFd() C.int ``` -------------------------------- ### Check System Call Argument Options Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Verifies if a raw argument contains all specified options, typically used for bitmask flags in system calls. Requires all options to be present for a true result. ```go func OptionAreContainedInArgument(rawArgument uint64, options ...SystemFunctionArgument) bool ``` -------------------------------- ### Compare OS Kernel Release Version Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Compares a given kernel version string to the current running kernel. Returns a KernelVersionComparison constant indicating if the provided version is older, equal, or newer than the running kernel. Consumers should use the package-defined constants for checking results. ```go func (btfi *OSInfo) CompareOSBaseKernelRelease(version string) (KernelVersionComparison, error) ``` -------------------------------- ### Get OS Release ID Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves the OSReleaseID, which represents the ID of the current Linux distribution. This can be used to identify specific distributions like Ubuntu, Fedora, or CentOS. ```go func (btfi *OSInfo) GetOSReleaseID() OSReleaseID ``` -------------------------------- ### TcHook Create Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Creates a new TC hook. ```go func (hook *TcHook) Create() error{ } ``` -------------------------------- ### Get All OS Release Field Values Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves all OSReleaseField values as strings from the current OS information. This function is useful for dumping the existing OSReleaseField's and their corresponding values. ```go func (btfi *OSInfo) GetOSReleaseAllFieldValues() map[OSReleaseField]string ``` -------------------------------- ### Get Specific OS Release Field Value Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Provides access to a specific OSReleaseField's value within the internal OSInfo structure. Use this to retrieve individual fields like OS name or version. ```go func (btfi *OSInfo) GetOSReleaseFieldValue(value OSReleaseField) string ``` -------------------------------- ### OSInfo.CompareOSBaseKernelRelease Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Compares the OS's base kernel release with a given version string. Returns a KernelVersionComparison result. ```APIDOC ## OSInfo.CompareOSBaseKernelRelease ### Description Compares the OS's base kernel release with a given version string. ### Parameters #### Path Parameters - `version` (string) - The kernel version string to compare against. ### Returns - `KernelVersionComparison`: The result of the comparison. ``` -------------------------------- ### Add Custom Kernel Configuration Option Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Allows users to extend the list of kconfigs by adding custom key-value pairs. This is useful for parsing kconfigs from a specified file path. ```go func (k *KernelConfig) AddCustomKernelConfig(key KernelConfigOption, value string) error ``` -------------------------------- ### BPFProg SetTracepoint Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Sets the BPF program as a tracepoint. This is a configuration method, likely used before attaching. ```go func (p *BPFProg) SetTracepoint() error ``` -------------------------------- ### GetOSInfo Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves comprehensive operating system information. Returns an OSInfo object and an error if retrieval failed. ```APIDOC ## GetOSInfo ### Description Retrieves comprehensive operating system information. ### Returns - `*OSInfo`: A pointer to the OSInfo object. - `error`: An error if retrieval failed, nil otherwise. ``` -------------------------------- ### ExecFlagArgument String Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Returns a string representation of the ExecFlagArgument. ```go func (e ExecFlagArgument) String() string ``` -------------------------------- ### BPFProg AttachRawTracepoint Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to a raw tracepoint. Requires the tracepoint event name. ```go func (p *BPFProg) AttachRawTracepoint(tpEvent string) (*BPFLink, error) ``` -------------------------------- ### UnameRelease Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Retrieves the kernel release version. Returns the release version as a string and an error if any occurred. ```APIDOC ## UnameRelease ### Description Retrieves the kernel release version. ### Returns - `string`: The kernel release version. - `error`: An error if retrieval failed, nil otherwise. ``` -------------------------------- ### NewModuleFromBuffer Function Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Creates a new BPF module from a byte buffer containing BPF object code. Requires the buffer and an optional object name. ```go func NewModuleFromBuffer(bpfObjBuff []byte, bpfObjName string) (*Module, error) ``` -------------------------------- ### BPFProg AttachPerfEvent Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to a perf event. Requires the file descriptor of the perf event. ```go func (p *BPFProg) AttachPerfEvent(fd int) (*BPFLink, error) ``` -------------------------------- ### BPFProg Methods Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Methods for interacting with BPF programs. ```APIDOC ## BPFProg Methods ### AttachKprobe #### Description Attaches the BPF program to a kprobe. #### Signature ```go func (p *BPFProg) AttachKprobe(kp string) (*BPFLink, error) ``` ### AttachKprobeLegacy #### Description Attaches the BPF program to a kprobe using legacy methods. #### Signature ```go func (p *BPFProg) AttachKprobeLegacy(kp string) (*BPFLink, error) ``` ### AttachKretprobe #### Description Attaches the BPF program to a kretprobe. #### Signature ```go func (p *BPFProg) AttachKretprobe(kp string) (*BPFLink, error) ``` ### AttachKretprobeLegacy #### Description Attaches the BPF program to a kretprobe using legacy methods. #### Signature ```go func (p *BPFProg) AttachKretprobeLegacy(kp string) (*BPFLink, error) ``` ### AttachLSM #### Description Attaches the BPF program to an LSM hook. #### Signature ```go func (p *BPFProg) AttachLSM() (*BPFLink, error) ``` ### AttachPerfEvent #### Description Attaches the BPF program to a performance event. #### Signature ```go func (p *BPFProg) AttachPerfEvent(fd int) (*BPFLink, error) ``` ### AttachRawTracepoint #### Description Attaches the BPF program to a raw tracepoint. #### Signature ```go func (p *BPFProg) AttachRawTracepoint(tpEvent string) (*BPFLink, error) ``` ### AttachTracepoint #### Description Attaches the BPF program to a tracepoint. #### Signature ```go func (p *BPFProg) AttachTracepoint(tp string) (*BPFLink, error) ``` ### AttachURetprobe #### Description Attaches the BPF program to a userspace return probe. #### Signature ```go func (p *BPFProg) AttachURetprobe(pid int, path string, offset uint32) (*BPFLink, error) ``` ### AttachUprobe #### Description Attaches the BPF program to a userspace probe. #### Signature ```go func (p *BPFProg) AttachUprobe(pid int, path string, offset uint32) (*BPFLink, error) ``` ### GetFd #### Description Gets the file descriptor of the BPF program. #### Signature ```go func (p *BPFProg) GetFd() C.int ``` ### GetType #### Description Gets the type of the BPF program. #### Signature ```go func (p *BPFProg) GetType() uint32 ``` ### SetAutoload #### Description Sets the autoload flag for the BPF program. #### Signature ```go func (p *BPFProg) SetAutoload(autoload bool) error ``` ### SetTracepoint #### Description Sets the tracepoint for the BPF program. #### Signature ```go func (p *BPFProg) SetTracepoint() error ``` ``` -------------------------------- ### BPFProg Methods Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Methods for attaching BPF programs to various kernel events and managing their properties. ```APIDOC ## BPFProg.AttachKprobe ### Description Attaches the BPF program to a kprobe. This API should be used for kernels > 4.17. ### Method `AttachKprobe(kp string) (*BPFLink, error)` ## BPFProg.AttachKprobeLegacy ### Description Attaches the BPF program to a kprobe using legacy methods. ### Method `AttachKprobeLegacy(kp string) (*BPFLink, error)` ## BPFProg.AttachKretprobe ### Description Attaches the BPF program to a kretprobe. This API should be used for kernels > 4.17. ### Method `AttachKretprobe(kp string) (*BPFLink, error)` ## BPFProg.AttachKretprobeLegacy ### Description Attaches the BPF program to a kretprobe using legacy methods. ### Method `AttachKretprobeLegacy(kp string) (*BPFLink, error)` ## BPFProg.AttachLSM ### Description Attaches the BPF program to an LSM hook. ### Method `AttachLSM() (*BPFLink, error)` ## BPFProg.AttachPerfEvent ### Description Attaches the BPF program to a perf event. ### Method `AttachPerfEvent(fd int) (*BPFLink, error)` ## BPFProg.AttachRawTracepoint ### Description Attaches the BPF program to a raw tracepoint. ### Method `AttachRawTracepoint(tpEvent string) (*BPFLink, error)` ## BPFProg.AttachTracepoint ### Description Attaches the BPF program to a tracepoint. ### Method `AttachTracepoint(tp string) (*BPFLink, error)` ## BPFProg.AttachURetprobe ### Description Attaches the BPF program to the exit of a symbol in a library or binary. A pid can be provided to attach to, or -1 can be specified to attach to all processes. ### Method `AttachURetprobe(pid int, path string, offset uint32) (*BPFLink, error)` ## BPFProg.AttachUprobe ### Description Attaches the BPF program to the entry of a symbol in a library or binary. A pid can be provided to attach to, or -1 can be specified to attach to all processes. ### Method `AttachUprobe(pid int, path string, offset uint32) (*BPFLink, error)` ## BPFProg.GetFd ### Description Returns the file descriptor of the BPF program. ### Method `GetFd() C.int` ## BPFProg.GetType ### Description Returns the type of the BPF program. ### Method `GetType() uint32` ## BPFProg.SetAutoload ### Description Enables or disables autoloading for the BPF program. ### Method `SetAutoload(autoload bool) error` ## BPFProg.SetTracepoint ### Description Sets the BPF program as a tracepoint. ### Method `SetTracepoint() error` ``` -------------------------------- ### BPFMapIterator Key Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Returns the current key as a byte slice during iteration. ```go func (it *BPFMapIterator) Key() []byte ``` -------------------------------- ### BPFProg SetAutoload Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Sets whether the BPF program should be autoloaded. Autoloading typically means it will be loaded when the module is loaded. ```go func (p *BPFProg) SetAutoload(autoload bool) error ``` -------------------------------- ### BPFMap KeySize Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Returns the size of the keys in the BPF map. ```go func (b *BPFMap) KeySize() int ``` -------------------------------- ### Load Kernel Configuration Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Reloads the kernel configuration from the kconfig file. This is typically used after modifying custom configurations. ```go func (k *KernelConfig) LoadKernelConfig() error ``` -------------------------------- ### Module GetMap Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Retrieves a BPF map by its name from the loaded module. ```go func (m *Module) GetMap(mapName string) (*BPFMap, error) ``` -------------------------------- ### CompareKernelRelease Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Compares two kernel release strings. Returns a KernelVersionComparison result and an error if comparison failed. ```APIDOC ## CompareKernelRelease ### Description Compares two kernel release strings. ### Parameters #### Path Parameters - `base` (string) - The base kernel release string. - `given` (string) - The kernel release string to compare against. ### Returns - `KernelVersionComparison`: The result of the comparison. - `error`: An error if the comparison failed, nil otherwise. ``` -------------------------------- ### Module TcHookInit Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Initializes a TcHook object, used for managing traffic control (TC) BPF programs. ```go func (m *Module) TcHookInit() *TcHook ``` -------------------------------- ### Kernel Version Comparison Constants Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Defines constants for comparing kernel release versions. ```go const ( KernelVersionInvalid KernelVersionComparison = iota - 1 KernelVersionEqual KernelVersionOlder KernelVersionNewer ) ``` -------------------------------- ### BPFProg AttachTracepoint Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to a tracepoint. Requires the tracepoint name. ```go func (p *BPFProg) AttachTracepoint(tp string) (*BPFLink, error) ``` -------------------------------- ### BPFMap Pin Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Pins the BPF map to a specified path, making it persistent. ```go func (b *BPFMap) Pin(pinPath string) error ``` -------------------------------- ### BPF Command Constants Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Defines constants for BPF commands (e.g., BPF_MAP_CREATE, BPF_PROG_LOAD) used with the 'bpf' syscall. ```go const ( BPF_MAP_CREATE BPFCommandArgument = iota BPF_MAP_LOOKUP_ELEM BPF_MAP_UPDATE_ELEM BPF_MAP_DELETE_ELEM BPF_MAP_GET_NEXT_KEY BPF_PROG_LOAD BPF_OBJ_PIN BPF_OBJ_GET BPF_PROG_ATTACH BPF_PROG_DETACH BPF_PROG_TEST_RUN BPF_PROG_GET_NEXT_ID BPF_MAP_GET_NEXT_ID BPF_PROG_GET_FD_BY_ID BPF_MAP_GET_FD_BY_ID BPF_OBJ_GET_INFO_BY_FD BPF_PROG_QUERY BPF_RAW_TRACEPOINT_OPEN BPF_BTF_LOAD BPF_BTF_GET_FD_BY_ID BPF_TASK_FD_QUERY BPF_MAP_LOOKUP_AND_DELETE_ELEM BPF_MAP_FREEZE BPF_BTF_GET_NEXT_ID BPF_MAP_LOOKUP_BATCH BPF_MAP_LOOKUP_AND_DELETE_BATCH BPF_MAP_UPDATE_BATCH BPF_MAP_DELETE_BATCH BPF_LINK_CREATE BPF_LINK_UPDATE BPF_LINK_GET_FD_BY_ID BPF_LINK_GET_NEXT_ID BPF_ENABLE_STATS BPF_ITER_CREATE BPF_LINK_DETACH ) ``` -------------------------------- ### BPFProg AttachLSM Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to an LSM (Linux Security Module) hook. ```go func (p *BPFProg) AttachLSM() (*BPFLink, error) ``` -------------------------------- ### TcHook Create Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Creates the necessary BPF objects and hooks for TC traffic control. ```go func (hook *TcHook) Create() error ``` -------------------------------- ### Socket Level Constants Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Provides constants for various socket levels, mapping to values from the unix package and some newer additions. ```go const ( SOL_SOCKET SocketLevelArgument = unix.SOL_SOCKET SOL_AAL SocketLevelArgument = unix.SOL_AAL SOL_ALG SocketLevelArgument = unix.SOL_ALG SOL_ATM SocketLevelArgument = unix.SOL_ATM SOL_CAIF SocketLevelArgument = unix.SOL_CAIF SOL_CAN_BASE SocketLevelArgument = unix.SOL_CAN_BASE SOL_CAN_RAW SocketLevelArgument = unix.SOL_CAN_RAW SOL_DCCP SocketLevelArgument = unix.SOL_DCCP SOL_DECNET SocketLevelArgument = unix.SOL_DECNET SOL_ICMPV6 SocketLevelArgument = unix.SOL_ICMPV6 SOL_IP SocketLevelArgument = unix.SOL_IP SOL_IPV6 SocketLevelArgument = unix.SOL_IPV6 SOL_IRDA SocketLevelArgument = unix.SOL_IRDA SOL_IUCV SocketLevelArgument = unix.SOL_IUCV SOL_KCM SocketLevelArgument = unix.SOL_KCM SOL_LLC SocketLevelArgument = unix.SOL_LLC SOL_NETBEUI SocketLevelArgument = unix.SOL_NETBEUI SOL_NETLINK SocketLevelArgument = unix.SOL_NETLINK SOL_NFC SocketLevelArgument = unix.SOL_NFC SOL_PACKET SocketLevelArgument = unix.SOL_PACKET SOL_PNPIPE SocketLevelArgument = unix.SOL_PNPIPE SOL_PPPOL2TP SocketLevelArgument = unix.SOL_PPPOL2TP SOL_RAW SocketLevelArgument = unix.SOL_RAW SOL_RDS SocketLevelArgument = unix.SOL_RDS SOL_RXRPC SocketLevelArgument = unix.SOL_RXRPC SOL_TCP SocketLevelArgument = unix.SOL_TCP SOL_TIPC SocketLevelArgument = unix.SOL_TIPC SOL_TLS SocketLevelArgument = unix.SOL_TLS SOL_X25 SocketLevelArgument = unix.SOL_X25 SOL_XDP SocketLevelArgument = unix.SOL_XDP // The following are newer, so aren't included in the unix package SOL_MCTCP SocketLevelArgument = 284 SOL_MCTP SocketLevelArgument = 285 SOL_SMC SocketLevelArgument = 286 ) ``` -------------------------------- ### TcHook Attach Method Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo Attaches a BPF program to a TC hook with specified options. ```go func (hook *TcHook) Attach(tcOpts *TcOpts) error{ } ``` -------------------------------- ### KernelConfigOption Constants Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Defines constants representing kernel configuration options, used for key=value syntax. ```go const ( CONFIG_BPF KernelConfigOption = iota + 1 CONFIG_BPF_SYSCALL CONFIG_HAVE_EBPF_JIT CONFIG_BPF_JIT CONFIG_BPF_JIT_ALWAYS_ON CONFIG_CGROUPS CONFIG_CGROUP_BPF CONFIG_CGROUP_NET_CLASSID CONFIG_SOCK_CGROUP_DATA CONFIG_BPF_EVENTS CONFIG_KPROBE_EVENTS CONFIG_UPROBE_EVENTS CONFIG_TRACING CONFIG_FTRACE_SYSCALLS CONFIG_FUNCTION_ERROR_INJECTION CONFIG_BPF_KPROBE_OVERRIDE CONFIG_NET CONFIG_XDP_SOCKETS CONFIG_LWTUNNEL_BPF CONFIG_NET_ACT_BPF CONFIG_NET_CLS_BPF CONFIG_NET_CLS_ACT CONFIG_NET_SCH_INGRESS CONFIG_XFRM CONFIG_IP_ROUTE_CLASSID CONFIG_IPV6_SEG6_BPF CONFIG_BPF_LIRC_MODE2 CONFIG_BPF_STREAM_PARSER CONFIG_NETFILTER_XT_MATCH_BPF CONFIG_BPFILTER CONFIG_BPFILTER_UMH CONFIG_TEST_BPF CONFIG_HZ CONFIG_DEBUG_INFO_BTF CONFIG_DEBUG_INFO_BTF_MODULES CONFIG_BPF_LSM CONFIG_BPF_PRELOAD CONFIG_BPF_PRELOAD_UMD CUSTOM_OPTION_START KernelConfigOption = 1000 ) ``` -------------------------------- ### KernelConfigOption.String Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Returns the string representation of the KernelConfigOption. ```APIDOC ## KernelConfigOption.String ### Description Returns the string representation of the KernelConfigOption. ### Returns - `string`: The string representation of the kernel config option. ``` -------------------------------- ### ExecFlagArgument.String Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Returns the string representation of the ExecFlagArgument. ```APIDOC ## ExecFlagArgument.String ### Description Returns the string representation of the ExecFlagArgument. ### Returns - `string`: The string representation of the execution flag. ``` -------------------------------- ### KernelConfig.LoadKernelConfig Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Loads the kernel configuration from its source. Returns an error if loading failed. ```APIDOC ## KernelConfig.LoadKernelConfig ### Description Loads the kernel configuration from its source. ### Returns - `error`: An error if loading failed, nil otherwise. ``` -------------------------------- ### NewKernelSymbolsMap Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Creates and returns a new KernelSymbolTable. Returns the symbol table and an error if creation failed. ```APIDOC ## NewKernelSymbolsMap ### Description Creates and returns a new KernelSymbolTable. ### Returns - `*KernelSymbolTable`: A pointer to the new kernel symbol table. - `error`: An error if creation failed, nil otherwise. ``` -------------------------------- ### Parse Set Socket Option Function Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Parses the raw uint64 value of the 'optname' argument for the setsockopt syscall. Refer to man pages for detailed information. ```go func ParseSetSocketOption(rawValue uint64) (SocketOptionArgument, error) ``` -------------------------------- ### CapabilityFlagArgument.String Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Returns the string representation of the CapabilityFlagArgument. ```APIDOC ## CapabilityFlagArgument.String ### Description Returns the string representation of the CapabilityFlagArgument. ### Returns - `string`: The string representation of the capability flag. ``` -------------------------------- ### Listen to Trace Pipe Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Reads data from the kernel's trace pipe (/sys/kernel/debug/tracing/trace_pipe) and writes it to standard output. This function is blocking and intended for debugging purposes only. It is not associated with any specific BPF program. ```go func TracePipeListen() error ``` -------------------------------- ### PrctlOptionArgument Constants Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Defines the possible options for the prctl system call. Use ParsePrctlOption to convert raw values. ```go type PrctlOptionArgument uint64 ``` ```go const ( PR_SET_PDEATHSIG PrctlOptionArgument = iota + 1 PR_GET_PDEATHSIG PR_GET_DUMPABLE PR_SET_DUMPABLE PR_GET_UNALIGN PR_SET_UNALIGN PR_GET_KEEPCAPS PR_SET_KEEPCAPS PR_GET_FPEMU PR_SET_FPEMU PR_GET_FPEXC PR_SET_FPEXC PR_GET_TIMING PR_SET_TIMING PR_SET_NAME PR_GET_NAME PR_GET_ENDIAN PR_SET_ENDIAN PR_GET_SECCOMP PR_SET_SECCOMP PR_CAPBSET_READ PR_CAPBSET_DROP PR_GET_TSC PR_SET_TSC PR_GET_SECUREBITS PR_SET_SECUREBITS PR_SET_TIMERSLACK PR_GET_TIMERSLACK PR_TASK_PERF_EVENTS_DISABLE PR_TASK_PERF_EVENTS_ENABLE PR_MCE_KILL PR_MCE_KILL_GET PR_SET_MM PR_SET_CHILD_SUBREAPER PR_GET_CHILD_SUBREAPER PR_SET_NO_NEW_PRIVS PR_GET_NO_NEW_PRIVS PR_GET_TID_ADDRESS PR_SET_THP_DISABLE PR_GET_THP_DISABLE PR_MPX_ENABLE_MANAGEMENT PR_MPX_DISABLE_MANAGEMENT PR_SET_FP_MODE PR_GET_FP_MODE PR_CAP_AMBIENT PR_SVE_SET_VL PR_SVE_GET_VL PR_GET_SPECULATION_CTRL PR_SET_SPECULATION_CTRL PR_PAC_RESET_KEYS PR_SET_TAGGED_ADDR_CTRL PR_GET_TAGGED_ADDR_CTRL ) ``` -------------------------------- ### Log and Exit on Error - Go Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/selftest/common Logs an error and exits the program. Use this for critical errors where the program cannot continue. ```go func Error(err error) ``` -------------------------------- ### Check for Missing Kernel Configuration Options Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Checks for any KernelConfigOptions that were marked as needed but could not be found. Returns an empty slice if all needed options are present. ```go func (k *KernelConfig) CheckMissing() []KernelConfigOption ``` -------------------------------- ### ExecFlagArgument Constants Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Provides predefined constants for various exec flags. ```go var ( AT_SYMLINK_NOFOLLOW ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} AT_EACCESS ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} AT_REMOVEDIR ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} AT_SYMLINK_FOLLOW ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} AT_NO_AUTOMOUNT ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} AT_EMPTY_PATH ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} AT_STATX_SYNC_TYPE ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} AT_STATX_SYNC_AS_STAT ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} AT_STATX_FORCE_SYNC ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} AT_STATX_DONT_SYNC ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} AT_RECURSIVE ExecFlagArgument = ExecFlagArgument{/* contains filtered or unexported fields */} ) ``` -------------------------------- ### KernelConfigOption and String() Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers KernelConfigOption is an abstraction for keys in the kernel config file's key=value syntax. The String() method provides a string representation of the option. ```APIDOC ## KernelConfigOption ### Description KernelConfigOption is an abstraction of the key in key=value syntax of the kernel config file. ### Constants - CONFIG_BPF - CONFIG_BPF_SYSCALL - CONFIG_HAVE_EBPF_JIT - CONFIG_BPF_JIT - CONFIG_BPF_JIT_ALWAYS_ON - CONFIG_CGROUPS - CONFIG_CGROUP_BPF - CONFIG_CGROUP_NET_CLASSID - CONFIG_SOCK_CGROUP_DATA - CONFIG_BPF_EVENTS - CONFIG_KPROBE_EVENTS - CONFIG_UPROBE_EVENTS - CONFIG_TRACING - CONFIG_FTRACE_SYSCALLS - CONFIG_FUNCTION_ERROR_INJECTION - CONFIG_BPF_KPROBE_OVERRIDE - CONFIG_NET - CONFIG_XDP_SOCKETS - CONFIG_LWTUNNEL_BPF - CONFIG_NET_ACT_BPF - CONFIG_NET_CLS_BPF - CONFIG_NET_CLS_ACT - CONFIG_NET_SCH_INGRESS - CONFIG_XFRM - CONFIG_IP_ROUTE_CLASSID - CONFIG_IPV6_SEG6_BPF - CONFIG_BPF_LIRC_MODE2 - CONFIG_BPF_STREAM_PARSER - CONFIG_NETFILTER_XT_MATCH_BPF - CONFIG_BPFILTER - CONFIG_BPFILTER_UMH - CONFIG_TEST_BPF - CONFIG_HZ - CONFIG_DEBUG_INFO_BTF - CONFIG_DEBUG_INFO_BTF_MODULES - CONFIG_BPF_LSM - CONFIG_BPF_PRELOAD - CONFIG_BPF_PRELOAD_UMD - CUSTOM_OPTION_START ### Method func (KernelConfigOption) String() string ``` -------------------------------- ### Check OS BTF Support Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Checks if the kernel has an embedded BTF (BPF Type Format) vmlinux file. Returns a boolean indicating support. ```go func OSBTFEnabled() bool ``` -------------------------------- ### NewKernelSymbolsMap Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers NewKernelSymbolsMap initializes the kernel symbol map by parsing the /proc/kallsyms file. The map uses a composite key of symbol owner and symbol name. ```APIDOC ## NewKernelSymbolsMap ### Description NewKernelSymbolsMap initiates the kernel symbol map by parsing the /proc/kallsyms file. Each line contains the symbol's address, segment type, name, and module owner. The key of the map is the symbol owner and the symbol name. ### Method func NewKernelSymbolsMap() (*KernelSymbolTable, error) ``` -------------------------------- ### BPFProgType.String Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Returns the string representation of the BPFProgType. ```APIDOC ## BPFProgType.String ### Description Returns the string representation of the BPFProgType. ### Returns - `string`: The string representation of the BPF program type. ``` -------------------------------- ### OpenFlagArgument.String Source: https://pkg.go.dev/github.com/aquasecurity/libbpfgo/helpers Returns the string representation of the OpenFlagArgument. ```APIDOC ## OpenFlagArgument.String ### Description Returns the string representation of the OpenFlagArgument. ### Returns - `string`: The string representation of the open flag. ```