{ "type": "excalidraw", "version": 2, "source": "https://excalidraw.com", "elements": [ { "id": "r798531260", "type": "rectangle", "x": 40, "y": 120, "width": 180, "height": 64, "angle": 0, "strokeColor": "#888888", "backgroundColor": "#f4f4f4", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 3 }, "seed": 615823973, "versionNonce": 1698432897, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false }, { "id": "t750371148", "type": "text", "x": 50, "y": 128, "width": 77.0, "height": 17.5, "angle": 0, "strokeColor": "#111111", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1991555487, "versionNonce": 1887709593, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "getdents64", "fontSize": 14, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "getdents64", "lineHeight": 1.25, "baseline": 14 }, { "id": "t1029096610", "type": "text", "x": 50, "y": 148, "width": 108.9, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1204873565, "versionNonce": 1704201638, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "writes dir entries", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "writes dir entries", "lineHeight": 1.25, "baseline": 11 }, { "id": "r1029770894", "type": "rectangle", "x": 290, "y": 108, "width": 250, "height": 88, "angle": 0, "strokeColor": "#e8870c", "backgroundColor": "#fff8ef", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 3 }, "seed": 1070492788, "versionNonce": 1628952137, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false }, { "id": "t245350117", "type": "text", "x": 300, "y": 116, "width": 107.80000000000001, "height": 17.5, "angle": 0, "strokeColor": "#111111", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 48777765, "versionNonce": 621804609, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "eBPF exit hook", "fontSize": 14, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "eBPF exit hook", "lineHeight": 1.25, "baseline": 14 }, { "id": "t1881810388", "type": "text", "x": 300, "y": 136, "width": 121.00000000000001, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 133316591, "versionNonce": 1524223051, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "bpf_probe_write_user", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "bpf_probe_write_user", "lineHeight": 1.25, "baseline": 11 }, { "id": "t1450634531", "type": "text", "x": 300, "y": 151, "width": 139.15, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1355270036, "versionNonce": 397662957, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "splices out /proc/", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "splices out /proc/", "lineHeight": 1.25, "baseline": 11 }, { "id": "r630816029", "type": "rectangle", "x": 620, "y": 120, "width": 220, "height": 64, "angle": 0, "strokeColor": "#2f6db5", "backgroundColor": "#eef4fb", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 3 }, "seed": 735818242, "versionNonce": 737201004, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false }, { "id": "t1667796194", "type": "text", "x": 630, "y": 128, "width": 100.10000000000001, "height": 17.5, "angle": 0, "strokeColor": "#111111", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1513333384, "versionNonce": 243687180, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "ps / ls /proc", "fontSize": 14, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "ps / ls /proc", "lineHeight": 1.25, "baseline": 14 }, { "id": "t1365466303", "type": "text", "x": 630, "y": 148, "width": 102.85000000000001, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 188869107, "versionNonce": 55229673, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "the entry is gone", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "the entry is gone", "lineHeight": 1.25, "baseline": 11 }, { "id": "a1149452789", "type": "arrow", "x": 220, "y": 152, "width": 70, "height": 0, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 2 }, "seed": 133156533, "versionNonce": 722637668, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "points": [ [ 0, 0 ], [ 70, 0 ] ], "lastCommittedPoint": null, "startBinding": null, "endBinding": null, "startArrowhead": null, "endArrowhead": "arrow" }, { "id": "t1458617125", "type": "text", "x": 255.0, "y": 138.0, "width": 66.55000000000001, "height": 13.75, "angle": 0, "strokeColor": "#555555", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1838636969, "versionNonce": 841512846, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "user buffer", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "user buffer", "lineHeight": 1.25, "baseline": 11 }, { "id": "a1644018207", "type": "arrow", "x": 540, "y": 152, "width": 80, "height": 0, "angle": 0, "strokeColor": "#b8650a", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 2, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": { "type": 2 }, "seed": 1447005939, "versionNonce": 1888894594, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "points": [ [ 0, 0 ], [ 80, 0 ] ], "lastCommittedPoint": null, "startBinding": null, "endBinding": null, "startArrowhead": null, "endArrowhead": "arrow" }, { "id": "t170566443", "type": "text", "x": 580.0, "y": 138.0, "width": 54.45, "height": 13.75, "angle": 0, "strokeColor": "#b8650a", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 1037118884, "versionNonce": 625683317, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "rewritten", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "rewritten", "lineHeight": 1.25, "baseline": 11 }, { "id": "t1466746400", "type": "text", "x": 440, "y": 24, "width": 477.95000000000005, "height": 13.75, "angle": 0, "strokeColor": "#b8650a", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 972984759, "versionNonce": 1575009384, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "the process still exists \u2014 it is edited out of what userspace is allowed to see", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "the process still exists \u2014 it is edited out of what userspace is allowed to see", "lineHeight": 1.25, "baseline": 11 }, { "id": "t172576250", "type": "text", "x": 440, "y": 276, "width": 538.45, "height": 13.75, "angle": 0, "strokeColor": "#888888", "backgroundColor": "transparent", "fillStyle": "solid", "strokeWidth": 1, "strokeStyle": "solid", "roughness": 1, "opacity": 100, "groupIds": [], "frameId": null, "roundness": null, "seed": 289255690, "versionNonce": 318488961, "isDeleted": false, "boundElements": [], "updated": 1, "link": null, "locked": false, "text": "DEFENSE: bpf_probe_write_user taints the kernel; compare /proc against the real task list", "fontSize": 11, "fontFamily": 1, "textAlign": "left", "verticalAlign": "top", "containerId": null, "originalText": "DEFENSE: bpf_probe_write_user taints the kernel; compare /proc against the real task list", "lineHeight": 1.25, "baseline": 11 } ], "appState": { "viewBackgroundColor": "#ffffff", "gridSize": null }, "files": {} }