diff --git a/driver/bpf/filler_helpers.h b/driver/bpf/filler_helpers.h index 2a4309779a7..a42fa500ce0 100644 --- a/driver/bpf/filler_helpers.h +++ b/driver/bpf/filler_helpers.h @@ -112,6 +112,9 @@ static __always_inline struct file *bpf_fget(int fd) * 2. we cannot use locks so we can face race conditions during the path reconstruction. * 3. reconstructed path could be slightly different from the one returned by `d_path`. * See pseudo_filesystem prefixes or the " (deleted)" suffix. + * + * Take a look at the research that led to this implementation: + * https://github.com/falcosecurity/libs/issues/1111 */ static __always_inline char *bpf_d_path_approx(struct filler_data *data, struct path *path) { diff --git a/driver/modern_bpf/helpers/store/auxmap_store_params.h b/driver/modern_bpf/helpers/store/auxmap_store_params.h index 81575b29274..b9aa74b7a2d 100644 --- a/driver/modern_bpf/helpers/store/auxmap_store_params.h +++ b/driver/modern_bpf/helpers/store/auxmap_store_params.h @@ -1473,6 +1473,9 @@ static __always_inline void apply_dynamic_snaplen(struct pt_regs *regs, u16 *sna * 3. reconstructed path could be slightly different from the one returned by `d_path`. * See pseudo_filesystem prefixes or the " (deleted)" suffix. * + * Take a look at the research that led to this implementation: + * https://github.com/falcosecurity/libs/issues/1111 + * * @param auxmap pointer to the auxmap in which we are storing the param. * @param path pointer to the path struct from which we will extract the path name */