From fe533386f0f3b761707a9fb52dce36f27e664f4a Mon Sep 17 00:00:00 2001 From: Rolf Neugebauer Date: Fri, 6 Jan 2017 16:52:16 +0000 Subject: [PATCH] docs: add a note about kernel symbols to the ebpf documentation Signed-off-by: Rolf Neugebauer --- docs/ebpf.md | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/docs/ebpf.md b/docs/ebpf.md index 7f9057aa2..ed5a893a7 100644 --- a/docs/ebpf.md +++ b/docs/ebpf.md @@ -15,3 +15,8 @@ You probably want to run with interactive use as some things use debugfs. You need at least `CAP_SYS_ADMIN` to do anything. There are examples in `bcc/examples` that should generally just work, I have tried several of the Lua ones. + +Some of the `iovisor/bcc` samples try to access the kernel symbols. For them to work correctly you should also execute: +```sh +echo 0 > /proc/sys/kernel/kptr_restrict +```