Skip to content

Fix BPF tracepoint attachment failure on kernel 6.12+ (EACCES) #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ardnew wants to merge 2 commits into
base: main
Choose a base branch
from
Open

Fix BPF tracepoint attachment failure on kernel 6.12+ (EACCES) #3

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6ceaa39
fix: use CO-RE reads in fork tracepoint for kernel 6.12+ compat
ardnew Mar 29, 2026
0d7cc81
bpf: remove redundant comment per PR comment
ardnew Mar 29, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
20 changes: 8 additions & 12 deletions bpf/sensor.c
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -53,15 +53,6 @@ struct chmod_event {
// tracepoint infrastructure — we skip them by starting our struct at the
// first tracepoint-specific field.

struct tp_fork_ctx {
// common fields (8 bytes) — not accessed directly
u64 __pad;
char parent_comm[16];
s32 parent_pid;
char child_comm[16];
s32 child_pid;
};

struct tp_exit_ctx {
u64 __pad;
char comm[16];
Expand Down Expand Up @@ -140,10 +131,15 @@ struct {

// Tracepoint: sched/sched_process_fork
// If parent is in a tracked subtree, add child to the same subtree.
// Uses CO-RE reads for parent_pid/child_pid because kernel 6.12+ changed
// the tracepoint layout (parent_comm/child_comm went from char[16] to
// __data_loc char[]), shifting field offsets. BPF_CORE_READ lets the
// loader resolve the correct offsets for the running kernel.
SEC("tracepoint/sched/sched_process_fork")
int tp_sched_process_fork(struct tp_fork_ctx *ctx) {
u32 parent_pid = ctx->parent_pid;
u32 child_pid = ctx->child_pid;
int tp_sched_process_fork(void *ctx) {
struct trace_event_raw_sched_process_fork *raw = ctx;
u32 parent_pid = BPF_CORE_READ(raw, parent_pid);
u32 child_pid = BPF_CORE_READ(raw, child_pid);

u32 *root = bpf_map_lookup_elem(&pid_to_root, &parent_pid);
if (root) {
Expand Down