[Tracking] Improvements over platform-specific information fetching

[ekoops]

This issue aims at documenting the effort of improving information gathering from specific platforms. We are already have an ongoing effort for improving procfs lookups: #2784 . Here we are broading the scope to include anything that can be done at platform-level. Some examples are adding support for fetching threads and files leveraging BPF iterators and leveraging netlink diag sockets to fetch information about task sockets.

---

Misc

• feat(userspace/libscap): add fetch_* APIs in linux vtable #2874

BPF iterators

• feat(userspace): add fetch APIs to libpman and wire it with linux platform #2886
• chore: add feature flag and debugging support for BPF iterators #2889
• chore(userspace/libpman): add support probing for BPF iterators #2890
• chore(userspace): disable auto-loading for unsup BPF iterator progs #2892
• chore(driver/modern_bpf): add some new helpers for BPF iterators #2894
• chore(driver/modern_bpf): add sleepable helpers for task-related paths #2901
• feat(driver/modern_bpf): add support for synchronously fetching tasks #2902
• feat(driver/modern_bpf): add support for synchronously fetching files #2903
• feat(userspace/libpman): add support for synchronously fetching tasks #2906
• feat(userspace/libpman): add support for synchronously fetching files #2907
• feat: add support for kernel iterator metrics #2909
• docs(driver/modern_bpf/programs/attached/iterators): add README.md #2910

[ekoops]

For visibility, I'm sharing here the same diagram shared in #2874 .
This could be useful for visualizing how linux platform code for fetching info is structured.
Note: dark red rectangles represents entry points

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[ekoops]

/remove-lifecycle stale