Module btf 

Just enough of the kernel’s BTF (/sys/kernel/btf/vmlinux) to find where a struct member lives, so the probes can read the netns of a request on any kernel: Rust eBPF has no CO-RE, so the loader resolves the offsets here and hands them to the object as globals (crate docs, “Namespaces”). Trusted code in the loader, so: read-only, every read bounds-checked, recursion bounded, and an answer only when each member found lies inside its struct; anything else is an error (the loader writes failed), never a panic.

Structs

Btf

CgroupOffsets

Where the probes find the sender’s cgroup names (crate docs, “Attribution”): task_struct.cgroups, css_set.dfl_cgrp, cgroup.kn, kernfs_node.name, and its parent (__parent since 6.15, parent before).

Member 🔒

NetdevOffsets

Where the register_netdevice probe finds the new device’s name and netns: net_device.name (char[IFNAMSIZ]) and net_device.nd_net.net.

NetnsOffsets

Where the probes find a request’s network namespace (crate docs, “Namespaces”): skb->sk, sk->__sk_common.skc_net.net, and net->ns.inum.

Ty 🔒

Constants

DEPTH 🔒

How deep anonymous members and typedef chains are followed.

KIND_ARRAY 🔒

KIND_CONST 🔒

KIND_DATASEC 🔒

KIND_DECL_TAG 🔒

KIND_ENUM 🔒

KIND_ENUM64 🔒

KIND_FLOAT 🔒

KIND_FUNC_PROTO 🔒

KIND_INT 🔒

KIND_PTR 🔒

KIND_RESTRICT 🔒

KIND_STRUCT 🔒

KIND_TYPEDEF 🔒

KIND_TYPE_TAG 🔒

KIND_UNION 🔒

KIND_VAR 🔒

KIND_VOLATILE 🔒

MAGIC 🔒

Functions

u32_at 🔒