Exclude unneeded progs

collector/CMakeLists.txt

@@ -103,6 +103,12 @@ set(SCAP_HOST_ROOT_ENV_VAR_NAME "COLLECTOR_HOST_ROOT" CACHE STRING "Host root en
 
 set(BUILD_LIBSCAP_MODERN_BPF ON CACHE BOOL "Enable modern bpf engine" FORCE)
 
-set(MODERN_BPF_EXCLUDE_PROGS "^(openat2|ppoll|setsockopt|clone3|io_uring_setup|nanosleep)$" CACHE STRING "Set of syscalls to exclude from modern bpf engine " FORCE)
+# Exclude unneeded progs, generated in a straightforward way as follow:
+# $ bpftool prog | grep tracing | awk '{print $4}' > all_progs.list
+# $ grep -v -f progs_in_use.list all_progs.list > collector/excluded_progs.list
+file(STRINGS "excluded_progs.list" EXCLUDED_PROGS_LIST)
+list(JOIN EXCLUDED_PROGS_LIST "|" EXCLUDED_PROGS)
+set(MODERN_BPF_EXCLUDE_PROGS "^(${EXCLUDED_PROGS})$" CACHE STRING "Set of syscalls to exclude from modern bpf engine " FORCE)
+message(INFO " Excluding ${MODERN_BPF_EXCLUDE_PROGS}")
 
 add_subdirectory(${FALCO_DIR} falco)

collector/excluded_progs.list

@@ -0,0 +1,138 @@
+access
+bind
+bpf
+brk
+capset
+chmod
+chown
+chroot
+clone3
+copy_file_range
+creat
+dup
+dup2
+dup3
+epoll_create
+epoll_create1
+epoll_wait
+eventfd
+eventfd2
+fchmod
+fchmodat
+fchown
+fchownat
+fcntl
+finit_module
+flock
+fsconfig
+fstat
+futex
+generic
+getcwd
+getdents
+getdents64
+getegid
+geteuid
+getgid
+getpeername
+getresgid
+getresuid
+getrlimit
+getsockname
+getuid
+init_module
+inotify_init
+inotify_init1
+ioctl
+io_uringnter
+io_uring_regist
+io_uring_setup
+kill
+lchown
+link
+linkat
+listen
+llseek
+lseek
+lstat
+memfd_create
+mkdir
+mkdirat
+mknod
+mknodat
+mlock
+mlock2
+mlockall
+mmap
+mmap2
+mount
+mprotect
+munlock
+munlockall
+munmap
+nanosleep
+open
+openat
+openat2
+open_by_handle
+pf_kernel
+pf_user
+pidfd_getfd
+pidfd_open
+pipe
+pipe2
+poll
+ppoll
+prctl
+pread64
+preadv
+prlimit64
+ptrace
+pwrite64
+pwritev
+quotactl
+read
+readv
+recv
+recvfrom
+recvmmsg
+recvmsg
+rename
+renameat
+renameat2
+rmdir
+seccomp
+select
+semctl
+semget
+semop
+send
+sendfile
+sendmmsg
+sendmsg
+sendto
+setns
+setpgid
+setrlimit
+setsid
+setsockopt
+signalfd
+signalfd4
+splice
+stat
+symlink
+symlinkat
+sysxit
+t1_drop
+t1_open_by_hand
+tgkill
+timerfd_create
+tkill
+umount
+umount2
+unlink
+unlinkat
+unshare
+userfaultfd
+write
+writev