Comment by westurner

Prompt 1C: Create a Go package named dbpftrace with a README and docs, then create a cli utility named dbpftrace to:

parse pid and descendents' fs syscall events (like bpftrace) using libbpfgo and godtrace

Use either (cilium/ebpf or libbpfgo or gobpf) or (godtrace or (CGO or FFI) bindings to libdtrace) depending on which OS, by default

cilium/ebpf: https://github.com/cilium/ebpf

aquasecurity/libbpfgo https://github.com/aquasecurity/libbpfgo

iovisor/gobpf w/ bcc: https://github.com/iovisor/gobpf

chzyer/godtrace: https://github.com/chzyer/godtrace

oracle/dtrace-utils/tree/devel/libdtrace: https://github.com/oracle/dtrace-utils/tree/devel/libdtrace

From https://news.ycombinator.com/item?id=45755142 re eBPF for WAF:

> awesome-ebpf > Kernel docs, examples, Go libraries: https://github.com/zoidyzoidzoid/awesome-ebpf#go-libraries :

>> Go libraries:

>> cilium/ebpf - Pure-Go library to read, modify and load eBPF programs and attach them to various hooks in the Linux kernel.

>> libbpfgo - eBPF library for Go, powered by libbpf.

>> gobpf - Go bindings for BCC for creating eBPF programs