feat(ebpf): Add Linux process event source - #729
Merged
rabbitstack merged 8 commits intoSep 14, 2026
Merged
Conversation
Linux run can now load CO-RE programs, snapshot processes through iter/task, and emit enriched execve/exit/clone events instead of failing as an unwired capture stub.
mostafa
marked this pull request as draft
September 14, 2026 11:22
Some kernels refuse a perf link on the legacy fork/vfork syscall tracepoints while clone and clone3 still attach. Treat those links as optional so the process source can open.
The exit and exit_group syscalls never return, so their raw syscall exit tracepoints never fire, and processes terminated by signals never enter exit_group at all. Attach a tp_btf program to sched_process_exit instead, emitting the raw wait status from the task exit code when the thread-group leader terminates. Also read effective instead of real credentials in every program so the uid/gid parameters match their documented semantics.
Drain the pending queue in rounds and only flip to live dispatch once the queue is empty, so replayed and live events cannot interleave out of ring buffer order. Size the output channel to the pending capacity so a full replay cannot block before the aggregator starts consuming. Assign the sequence number at dispatch and increment it only for events that pass exclusion and filtering, mirroring the Windows consumer.
Guard single instance with an abstract UNIX domain socket that the kernel releases automatically on process termination, replacing the flock file in a world-writable directory. Drop the no-op debug privilege option since the concept does not exist on Linux. Import internal/ebpf under the libebpf alias and give the Windows signal handler its platform suffix now that a Linux counterpart exists.
mostafa
force-pushed
the
feat/linux-ebpf-process-source
branch
from
September 14, 2026 11:51
b4641de to
aa5ffb3
Compare
mostafa
marked this pull request as ready for review
September 14, 2026 12:05
rabbitstack
approved these changes
Sep 14, 2026
rabbitstack
left a comment
rabbitstack
left a comment
Owner
There was a problem hiding this comment.
Overall, looks pretty solid. Just a few naming nits and some questions. Approving...
Drop the kind field: it always mirrored the type, which alone designates the event topology, with zero reserved for iter/task snapshot records that map to the unknown type and can never leak as live events. Removing it also removes the explicit alignment padding. Rename the record struct to syscall_event, generalize clone_flags to a per-type flags field ahead of wider telemetry, and rename attachHotPath to attachPrograms with a comment contrasting the continuous live-capture programs against the one-shot snapshot iterator.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What is the purpose of this PR / why it is needed?
Adds the live Linux eBPF process source so
fibratus runcan captureexecve,exit, andcloneinstead of stopping at an unwired capture stub. The source loads committed CO-RE objects, shares maps across separately generated collections, snapshots thread-group leaders withiter/task, and reconciles hot events against that baseline using PID plus start boot time.Successful clones take child identity from
sched_process_fork, and process exits are emitted fromsched_process_exitbecauseexit/exit_groupnever return (their syscall exit tracepoints never fire) and signal-terminated processes never invoke them. Filename bytes forexecve/execveatare copied into a scratch map on enter so a successful exec cannot reread a replaced address space. Executable path and cmdline are best-effort/proc/<pid>/{exe,cmdline}reads only. Missing kernel 5.9, usable/sys/kernel/btf/vmlinux, or required program/map helpers fail the open path with a concrete error.What type of change does this PR introduce?
/kind feature
Any specific area of the project related to this PR?
/area instrumentation
/area telemetry
/area tests
/area ci
/area build
Special notes for the reviewer
linux-port, notmaster.bpf2gobindings and.oobjects are committed. Ordinary Linux builds do not need clang.internal/ebpf/generate.shregenerates them.events,drop_count,scratch) are owned by the execve collection and injected into exit/clone/iterator collections withMapReplacements.iter/task, upsert baseline process state, replay pending events in ring-buffer order, then switch to live dispatch.unix://), and signal handling. Filaments remain unsupported.CAP_BPF,CAP_PERFMON, andCAP_SYS_PTRACEfor incidental/procenrichment.go test ./internal/ebpf ./internal/bootstrap ./pkg/event ./pkg/ps ./pkg/api ./pkg/util/signalsgo build -o /tmp/fibratus ./cmd/fibratusGOOS=windows GOARCH=amd64 go test -exec=true ./pkg/event ./pkg/util/signals ./pkg/api ./internal/bootstrapDoes this PR introduce a user-facing change?
Yes. On a 5.9+ kernel with runtime BTF,
fibratus runopens the eBPF process source and emits enrichedexecve,exit, andcloneevents into the existing aggregator and outputs path.