Use kallsyms iterator to read kernel symbols and addresses in restricted environments.
Author: usamasaqibCreated Aug 13, 2026Updated Aug 24, 2026
Hello. In environments where kptr_restrict is set to 2, or where CAP_SYSLOG is unavailable, we can fail to read kernel symbol addresses from /proc/kallsyms. I want to write a fallback mechanism for this based on kallsysms bpf iterator. I have two possible approaches in mind, and I am looking for feedback on these.
- Have the library itself fallback to using the bpf iterator when we cannot read addresses from kallsyms. The main downside for this is that the library will now need to manage the bpf program which can be complicated depending on the environment it is running in.
- Expose some way for the symbols to be read via a user defined callback. This way the bpf program management is done by the userspace application.
I would appreciate guidance on what approach is preferable here.
Source: cilium/ebpf