Prerequisites

• Linux kernel version >= 4.18

One of the following:

• BTF available under /sys/kernel/btf/vmlinux (see libbpf CO-RE documentation for more info).
• Linux kernel headers available under conventional location (see Linux Headers section for more info). In this case system libraries libelf and zlib are required as well.
• Tracee's eBPF probe pre-compiled (see eBPF compilation section for more info).

Permissions

For using the eBPF Linux subsystem, Tracee needs to run with sufficient capabilities:

• CAP_SYS_RESOURCE (to manage eBPF maps limits)
• CAP_BPF+CAP_PERFMON which are available on recent kernels (>=5.8), or CAP_SYS_ADMIN on older kernels (to load and attach the eBPF programs).
• On some environments (e.g. Ubuntu) CAP_IPC_LOCK might be required as well.

Alternatively, run as root or with the --privileged flag of Docker.