Crate aya_ebpf_macros 

Attribute Macros

btf_map

btf_tracepoint

Marks a function as a BTF-enabled raw tracepoint eBPF program that can be attached at a pre-defined kernel trace point.

cgroup_device

Marks a function as a cgroup device eBPF program that can be attached to a cgroup.

cgroup_skb

cgroup_sock

cgroup_sock_addr

Marks a function as a CgroupSockAddr eBPF program.

cgroup_sockopt

cgroup_sysctl

classifier

fentry

Marks a function as a fentry eBPF program that can be attached to almost any function inside the kernel. The difference between fentry and kprobe is that fexit has practically zero overhead to call before kernel function. fentry programs can be also attached to other eBPF programs.

fexit

Marks a function as a fexit eBPF program that can be attached to almost any function inside the kernel. The difference between fexit and kretprobe is that fexit has practically zero overhead to call after kernel function and it focuses on access to arguments rather than the return value. fexit programs can be also attached to other eBPF programs

flow_dissector

Marks a function as an eBPF Flow Dissector program.

kprobe

kretprobe

lsm

Marks a function as an LSM program that can be attached to Linux LSM hooks. Used to implement security policy and audit logging.

lsm_cgroup

Marks a function as an LSM program that can be attached to cgroups. This program will only trigger for workloads in the attached cgroups. Used to implement security policy and audit logging.

map

perf_event

raw_tracepoint

Marks a function as a raw tracepoint eBPF program that can be attached at a pre-defined kernel trace point.

sk_lookup

Marks a function as an eBPF Socket Lookup program that can be attached to a network namespace.

sk_msg

sock_ops

socket_filter

Marks a function as a eBPF Socket Filter program that can be attached to a socket.

stream_parser

Marks a function as a SK_SKB Stream Parser eBPF program that can be attached to a SockMap

stream_verdict

Marks a function as a SK_SKB Stream Verdict eBPF program that can be attached to a SockMap

tracepoint

uprobe

uretprobe

xdp

Marks a function as an eBPF XDP program that can be attached to a network interface.