From bb57b3882e3af773bdac2d4e9c92159bb084c148 Mon Sep 17 00:00:00 2001 From: stevenGravy Date: Wed, 1 Jan 2025 10:25:38 -0500 Subject: [PATCH] update bpf readme --- bpf/README.md | 10 ++-------- 1 file changed, 2 insertions(+), 8 deletions(-) diff --git a/bpf/README.md b/bpf/README.md index b2adfe68aeee9..d7169a47ed09d 100644 --- a/bpf/README.md +++ b/bpf/README.md @@ -79,17 +79,11 @@ Example: ## BPF in Teleport -Teleport uses BPF to implement enhanced session recording and restricted networking. Both features work only on Linux with +Teleport uses BPF to implement enhanced session recording. Enhanced session recording works only on Linux with the kernel 5.8+. Enhanced session recording records all: * exec family system calls * open family system calls * network connections -All events are recorded in the audit log. See https://goteleport.com/docs/server-access/guides/bpf-session-recording/. - -Restricted networking allows you to restrict network access for users. -It's implemented by using LSM hooks and BPF programs ( -see https://goteleport.com/docs/server-access/guides/restricted-session/). -On ubuntu systems LSM hooks are not enabled in some versions. -Here are the instructions on how to enable them https://github.com/gravitational/teleport/issues/8089#issuecomment-924990678. +All events are recorded in the audit log. See https://goteleport.com/docs/enroll-resources/server-access/guides/bpf-session-recording/.