eBPF Учебник на Примерах 6: Захват Отправки Сигналов и Хранение Состояния с Помощью Хэш-Карт

Оригинал

eBPF Tutorial by Example 6: Capturing Signal Sending and Store State with Hash Maps

eBPF (Extended Berkeley Packet Filter) is a powerful network and performance analysis tool on the Linux kernel that allows developers to dynamically load, update, and run user-defined code at runtime. This article is the sixth part of the eBPF Tutorial by Example. It mainly introduces how to implement an eBPF tool that captures a collection of system calls that send signals to processes and uses a hash map to store state. sigsnoop The example code is as follows: #include <vmlinux