Deprecate procfs
backend for add_session_metadata
#42934
Labels
Team:Security-Linux Platform
Linux Platform Team in Security Solution
As recently demonstrated here (#42398), the procfs backend for the session metadata processor is extremely prone to data loss by nature of its design, and the kprobe-based backend generally works better for most things.
However, we need some kind of strategy for actually deprecating this, since its still used as a fallback, and is probably seeing some amount of use on systems where permission issues prevent the kprobe backend from starting up. We need some kind of documentation, most likely geared towards k8s/docker users, telling them what permissions switches to flip in order to get the kprobe backend working.
There's two steps to this:
procfs
backendThe text was updated successfully, but these errors were encountered: