Documentation
¶
Overview ¶
Package bpfloader manages the lifecycle of eBPF programs and their kernel attachments.
Index ¶
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
This section is empty.
Types ¶
type Loader ¶
type Loader struct {
// contains filtered or unexported fields
}
Loader manages the lifecycle of BPF programs and their attachments.
func NewWithOptions ¶ added in v0.5.0
func NewWithOptions(opts LoaderOptions) (*Loader, error)
NewWithOptions creates a new Loader with the given options.
func (*Loader) Close ¶
Close releases all BPF resources including links and loaded objects. Link detachments are parallelized since each involves kernel RCU synchronization (~200ms).
func (*Loader) OpenRingBuffer ¶
OpenRingBuffer opens and returns a ring buffer reader for receiving events.
func (*Loader) UntrackPID ¶ added in v0.5.0
UntrackPID removes a PID from the tracked_pids map in the BPF program.
type LoaderOptions ¶ added in v0.5.0
type LoaderOptions struct {
AmbientMode bool // Enable daemon mode (monitor all execs, not just tracked trees)
RingBufferSize int // Ring buffer size in bytes (0 = default 2MB)
}
LoaderOptions configures BPF program loading behavior.
Source Files
Click to show internal directories.
Click to hide internal directories.