Re:Using BPF to Transform SSH Sessions into Structured Events
by cyphar on Friday February 28, 2020 @07:20AM
(#22442251)
Though it should be noted that's not quite the same thing as execve. Execve does a lot of things in addition to running the main function (privilege transitions like setuid being just one example).
[ Parent
| on HN ]
Re:Using BPF to Transform SSH Sessions into Structured Events
by saagarjha on Friday February 28, 2020 @07:27AM
(#22442283)
Of course; in addition to kernel setup this will also skip over initializers in the binary and other things that the C runtime does before main. Needless to say, this is mostly only useful as a fun side effect of PIE executables.