Add kprobepin example showing how to re-use a pinned map in a BPF prog

[ungureanuvladvictor]

Chatted with @ti-mo on Slack about adding an example on how to re-use a pinned map given this is something supported by the library. I figured out the current kprobe example is pretty good given it keeps a counter of how many time sys_execve got called.

[lmb]

Can you add a comment that explains what this does? Plus, please use a subdirectory of /sys/fs/bpf: filepath.Join(bpfFSPath, "execve_probe").

[ungureanuvladvictor]

Ended up calling os.MkdirAll which is a no-op if the path exists, let me know if this is good.

[lmb]

Thanks!

[ti-mo]

Very clean, thanks!

[zhangzhiqiangcs]

Hello, all, I run into this kprobepin demo with the problem that

failed to create bpf fs subpath: mkdir /sys/fs/bpf/sys_execve: no such file or directory

but I have /sys/fs/bpf/ directory and filesystem is sysfs.

Any ideas or documents can help with this situation?

Thanks for any help.

[zhangzhiqiangcs]

found a issue: #926

[ti-mo]

@zhangzhiqiangcs /sys/fs/bpf needs to be of type bpffs, not sysfs. Your distribution's init system (I assume you're also on wsl2?) usually takes care of setting this up.

Otherwise: mount -t bpf bpf /sys/fs/bpf.

[zhangzhiqiangcs]

@ti-mo Sorry to forget paste my os-release. My machine is Ubuntu 18.04 .

I am not sure why /sys/fs/bpf is exists and is sysfs type.

Execute command mount -t bpf bpf /sys/fs/bpf really solved my problem. Now the example runs as expect! Thank you very much !