tree 31f9c7975172d9383766207075986a34e8ccf646
parent 26e3a096a4eb4edd8bbcaab57ac8df38e6594a1d
author Andrew G. Morgan <morgan@kernel.org> 1663545400 -0700
committer Andrew G. Morgan <morgan@kernel.org> 1663545400 -0700

Add an example of using BPF kprobing to trace capability use.

$ make
$ sudo go/captrace your-program

will attempt to explore what capabilities are needed to run
your program by observing when cap_capable() inside the kernel
is associated with your-program.

Other ways to invoke this are

$ sudo go/captrace --pid=<pid>
$ sudo go/captrace

The last of these traces everything running on a system.

Signed-off-by: Andrew G. Morgan <morgan@kernel.org>