the Game eBPF enables: ▶ Fine-grained system introspection ▶ Integration of cross-layer state (kprobes, uprobes, etc.) with policy enforcement (LSM probes) ▶ Rapid prototyping ▶ Safe production deployment daemon using the Python3 bcc framework ▶ Kernelspace components are all eBPF ▶ LSM probes (KRSI), kprobes, uprobes, tracepoints ▶ Under 2000 source lines of kernelspace code ▶ Thanks to eBPF, bpfbox is

various hooking points in the kernel such as for incoming packets, outgoing packets, system calls, kprobes, etc. BPF con�nues to evolve and gain addi�onal capabili�es with each new Linux release. Cilium and XDP programs, there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsec�ons provide further details on individual aspects packet is received, a kernel address which has a kprobes with a BPF program a�ached will trap once the code at that address gets executed, then invoke the kprobes callback func�on for instrumenta�on which subsequently

with uprobes 6 Demo time 7 Conclusions ● eBPF programs can be attached to different events: ○ Kprobes ○ uprobes ○ Tracepoints ○ network packets… ● Frameworks, Go bindings, options make it easier:

/trace/events.rst  $KERNEL_SRC/Documentation/trace/ftrace*.rst  $KERNEL_SRC/Documentation/kprobes  $KERNEL_SRC/Documentation/trace/kprobetrace.rst  $KERNEL_SRC/Documentation/trace/uprobetracer

various hooking points in the kernel such as for incoming packets, outgoing packets, system calls, kprobes, etc. BPF continues to evolve and gain additional capabilities with each new Linux release. Cilium and XDP programs, there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects kernel tracing utilities all based upon BPF programs hooking into kernel infrastructure based upon kprobes, kretprobes, tracepoints, uprobes, uretprobes as well as USDT probes. The collection provides close

various hooking points in the kernel such as for incoming packets, outgoing packets, system calls, kprobes, etc. BPF continues to evolve and gain additional capabilities with each new Linux release. Cilium and XDP programs, there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects kernel tracing utilities all based upon BPF programs hooking into kernel infrastructure based upon kprobes, kretprobes, tracepoints, uprobes, uretprobes as well as USDT probes. The collection provides close

[sudo] password for kdas: abi.vsyscall32 = 1 crypto.fips_enabled = 0 debug.exception-trace = 1 debug.kprobes-optimization = 1 dev.cdrom.autoclose = 1 dev.cdrom.autoeject = 0 dev.cdrom.check_media = 0 dev.cdrom

[sudo] password for kdas: abi.vsyscall32 = 1 crypto.fips_enabled = 0 debug.exception-trace = 1 debug.kprobes-optimization = 1 dev.cdrom.autoclose = 1 dev.cdrom.autoeject = 0 dev.cdrom.check_media = 0 dev.cdrom

and XDP programs, there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects kernel tracing utilities all based upon BPF programs hooking into kernel infrastructure based upon kprobes, kretprobes, tracepoints, uprobes, uretprobes as well as USDT probes. The collection provides close Language’ approach of yore, and compiles ply scripts into Linux BPF programs that are attached to kprobes and tracepoints in the kernel. The scripts have a C-like syntax, heavily inspired by DTrace and by

and XDP programs, there are various other kernel subsystems as well which use BPF such as tracing (kprobes, uprobes, tracepoints, etc). The following subsections provide further details on individual aspects kernel tracing utilities all based upon BPF programs hooking into kernel infrastructure based upon kprobes, kretprobes, tracepoints, uprobes, uretprobes as well as USDT probes. The collection provides close Language’ approach of yore, and compiles ply scripts into Linux BPF programs that are attached to kprobes and tracepoints in the kernel. The scripts have a C-like syntax, heavily inspired by DTrace and by