#1033013 execsnoop truncates arguments output

Package:
libbpf-tools
Source:
libbpf-tools
Description:
tools for BPF Compiler Collection based on libbpf (BTF and CO-RE)
Submitter:
Antoine Beaupre
Date:
2023-03-15 17:15:03 UTC
Severity:
normal
#1033013#5
Date:
2023-03-15 17:13:52 UTC
From:
To:
execsnoop is super useful, but fails rather ungracefully if the
commandline argument is longer than 128 characters.

i have tried to improve that with a patch, but couldn't figure out
why.

execsnoop.bt in the bpftrace package doesn't suffer from this
limitation, so it's not a problem in the kernel itself.

See also: https://github.com/iovisor/bcc/issues/740