{"id":20934373,"url":"https://github.com/knightchaser/hello-ebpf","last_synced_at":"2026-05-16T11:33:57.185Z","repository":{"id":261177455,"uuid":"883500967","full_name":"KnightChaser/hello-eBPF","owner":"KnightChaser","description":"Example hands-on codes for exercising eBPF(Extended Berkeley Packet Filter) on Linux Kernel via eunomia-bpf/libbpf","archived":false,"fork":false,"pushed_at":"2024-11-26T17:03:48.000Z","size":75748,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":1,"default_branch":"main","last_synced_at":"2025-03-13T02:31:31.564Z","etag":null,"topics":["ebpf","kernel","libbpf"],"latest_commit_sha":null,"homepage":"","language":"C","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/KnightChaser.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2024-11-05T04:26:11.000Z","updated_at":"2024-11-26T17:03:51.000Z","dependencies_parsed_at":"2024-11-26T18:32:18.079Z","dependency_job_id":null,"html_url":"https://github.com/KnightChaser/hello-eBPF","commit_stats":null,"previous_names":["knightchaser/hello-eunomia-bpf","knightchaser/hello-ebpf"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/KnightChaser/hello-eBPF","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fhello-eBPF","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fhello-eBPF/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fhello-eBPF/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fhello-eBPF/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/KnightChaser","download_url":"https://codeload.github.com/KnightChaser/hello-eBPF/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/KnightChaser%2Fhello-eBPF/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":266732739,"owners_count":23976093,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","status":"online","status_checked_at":"2025-07-23T02:00:09.312Z","response_time":66,"last_error":null,"robots_txt_status":null,"robots_txt_updated_at":null,"robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","kernel","libbpf"],"created_at":"2024-11-18T22:07:50.513Z","updated_at":"2025-09-25T10:31:47.222Z","avatar_url":"https://github.com/KnightChaser.png","language":"C","funding_links":[],"categories":[],"sub_categories":[],"readme":"# hello-eBPF\n\nPlaying with eBPF on Linux, which enables you to see deep internals of Linux system :)\n\n## Note\n\nTo create `vmlinux.h` which was used in the given exercise eBPF code, run\n\n```bash\nsudo apt update\nsudo apt install linux-headers-$(uname -r) clang llvm libbpf-dev gcc-multilib make\nbpftool btf dump file /sys/kernel/btf/vmlinux format c \u003e vmlinux.h\n```\n\nIt requires [`libbpf`](https://github.com/libbpf/libbpf) with `1.0.0` or later version(preferably, `v1.5.0` or later) to make the codes compatible with Ubuntu kernel version 6, not only 5.\n\nMake sure about the version\n\n```bash\nroot@liberra:~/gh-repo/hello-eBPF/application/00_execve_tracking$ locate pkgconfig | grep libbpf\n/usr/lib64/pkgconfig/libbpf.pc\nroot@liberra:~/gh-repo/hello-eBPF/application/00_execve_tracking$ pkg-config  --modversion libbpf\n1.5.0\nroot@liberra:~/gh-repo/hello-eBPF/application/00_execve_tracking$ pkg-config libbpf --libs --cflags\n-L/usr/lib64 -lbpf\n```\n\nIf the version is not properly upgraded, use the following shell script so the package manager can correctly direct the intended version of `libbpf` package.\n```bash\necho 'export PKG_CONFIG_PATH=/usr/lib64/pkgconfig:$PKG_CONFIG_PATH' \u003e\u003e ~/.bashrc\necho \"/usr/lib64\" | sudo tee /etc/ld.so.conf.d/libbpf.conf\nsudo ldconfig\nsource ~/.bashrc\n```\n\n## Note for newbies like me\n\n### 1. **`LD_LIBRARY_PATH` Only Affects the Current Session**\n\n- The `LD_LIBRARY_PATH` environment variable is session-based, meaning it only affects the session where it’s set.\n- It doesn’t persist after logging out or restarting.\n- Running commands with `sudo` typically creates a new session that doesn’t inherit `LD_LIBRARY_PATH` unless you use `sudo -E`. However, using `sudo -E` is not always ideal for security or consistency.\n\n### 2. **`/etc/ld.so.conf.d/` Provides a Persistent, System-Wide Path**\n\n- Adding paths to files in `/etc/ld.so.conf.d/` (e.g., `/etc/ld.so.conf.d/libbpf.conf`) makes them available to all users and sessions, including `sudo`.\n- After adding a library path here, running `ldconfig` updates the system’s library cache so these paths are always available. This is particularly useful for system-wide installations or when multiple users need access to the libraries.\n\n### 3. **The Purpose of `ldconfig` for Updating the Library Cache**\n\n- `ldconfig` updates `/etc/ld.so.cache`, which the linker (`ld.so`) uses to locate libraries. This makes searches for libraries more efficient and ensures consistency across all user sessions.\n- Running `ldconfig` after adding a path in `/etc/ld.so.conf.d/` makes the new path available immediately without needing to modify `LD_LIBRARY_PATH` in each session.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknightchaser%2Fhello-ebpf","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fknightchaser%2Fhello-ebpf","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fknightchaser%2Fhello-ebpf/lists"}