Skip to content

Commit

Permalink
Update FAQs.md
Browse files Browse the repository at this point in the history
  • Loading branch information
gustavo-iniguez-goya authored May 1, 2024
1 parent f995106 commit e29e1e4
Showing 1 changed file with 3 additions and 20 deletions.
23 changes: 3 additions & 20 deletions wiki/FAQs.md
Original file line number Diff line number Diff line change
Expand Up @@ -64,27 +64,9 @@ Kernels support

Your kernel needs some features to be enabled in order eBPF to work: debugfs (or tracefs), kprobes, perf events, ftrace and syscalls (bpf and ftrace).

You can check if they're available for your kernel with the following commands:

```bash
$ grep -E "(BPF|FTRACE|KPROBE)" /boot/config-$(uname -r)
CONFIG_CGROUP_BPF=y
CONFIG_BPF=y
CONFIG_BPF_SYSCALL=y
CONFIG_BPF_EVENTS=y
CONFIG_KPROBES=y
CONFIG_KPROBE_EVENTS=y
CONFIG_FTRACE=y
CONFIG_FTRACE_SYSCALLS=y
```
If any of the above options appears as "is not set", your kernel lacks support for it.

```bash
$ sudo ls /sys/kernel/debug/tracing/kprobe_events
$ sudo ls /sys/kernel/debug/tracing/events/syscalls/
```
Since version 1.6.x you can execute the following command to know if your kernel has all the expected features:

If some of the above commands outputs "no such file or directory", your kernel lacks support for it.
`opensnitchd -check-requirements`

[More info](https://github.com/evilsocket/opensnitch/tree/master/ebpf_prog)

Expand Down Expand Up @@ -158,6 +140,7 @@ https://github.com/evilsocket/opensnitch/discussions/791
https://github.com/evilsocket/opensnitch/discussions/743
https://github.com/evilsocket/opensnitch/discussions/742
https://github.com/evilsocket/opensnitch/discussions/564
https://github.com/evilsocket/opensnitch/discussions/1100

If you create a rule to allow `wget` or `curl` system-wide, a malicious process may use of it to download remote files, so it all depends on what rules you define:

Expand Down

0 comments on commit e29e1e4

Please sign in to comment.