From 11619402567399b4f14644492fd954f0f49cae42 Mon Sep 17 00:00:00 2001 From: Rafael David Tinoco Date: Mon, 12 Dec 2022 17:52:47 +0000 Subject: [PATCH] libbpf: mitigate libbpf_print_fn issues for tracee --- libbpfgo.h | 6 ++++++ 1 file changed, 6 insertions(+) diff --git a/libbpfgo.h b/libbpfgo.h index a53c20d0..bca2a25e 100644 --- a/libbpfgo.h +++ b/libbpfgo.h @@ -35,6 +35,12 @@ int libbpf_print_fn(enum libbpf_print_level level, // libbpf print level return 0; } + // BUG: https://github.com/aquasecurity/tracee/issues/2446 + if (strstr(str, "failed to create kprobe") != NULL) { + if (strstr(str, "trace_check_map_func_compatibility") != NULL) + return 0; + } + // AttachCgroupLegacy() will first try AttachCgroup() and it might fail. This // is not an error and is the best way of probing for eBPF cgroup attachment // link existence.