fact/src/bpf/checks.rs (1)

34-42: 📐 Maintainability & Code Quality | 🔵 Trivial | ⚡ Quick win

Consider logging the underlying error before treating any load failure as "unsupported."

probe_hook returns false for missing programs, wrong program type, and load failures alike, discarding the error from prog.load(...). This is fine for genuinely unsupported kernels, but it also silently masks a real bug (e.g. a verifier failure in checks.c) as "capability not supported," making such regressions hard to diagnose.

♻️ Suggested diagnostic logging

     fn probe_hook(obj: &mut aya::Ebpf, prog_name: &str, hook: &str, btf: &Btf) -> bool {
         let Some(prog) = obj.program_mut(prog_name) else {
             return false;
         };
         let Ok(prog): Result<&mut Lsm, _> = prog.try_into() else {
             return false;
         };
-        prog.load(hook, btf).is_ok()
+        match prog.load(hook, btf) {
+            Ok(()) => true,
+            Err(e) => {
+                debug!("Failed to probe {hook} support via {prog_name}: {e:#?}");
+                false
+            }
+        }
     }

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@fact/src/bpf/checks.rs` around lines 34 - 42, `probe_hook` is swallowing real
load errors by returning false for every failure case. Update the function to
log the underlying error from `prog.load(hook, btf)` before mapping it to
unsupported, while keeping the existing false behavior for missing programs and
wrong program types. Use the `probe_hook` function and the `Lsm` load path to
locate the change, and make sure the log clearly distinguishes load failures
from genuinely unsupported kernels.

Source: Path instructions

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes