eBPF for Runtime Security
summary
eBPF loads small programs into the kernel to observe and act on process, file and network events; observability uses maps and userland readers while security needs checks at the kernel’s data structures not syscall entry. Demonstrations show BPF LSM 5.7 gives safe hooks to see real file targets, older kernels use kprobes (Tetragon) to attach to stable functions, a DaemonSet agent loads policies and a tetragon kill policy synchronously stops a write to /etc before it completes. Inspector Gadget and Pixie/Hubble provide Kubernetes context.
AI-written summary · about
chapters (15)
- 0:00Introduction to eBPF
- 1:56What is eBPF
- 4:03Hello World eBPF demo
- 6:53eBPF observability tools
- 9:47eBPF in containerized environments
- 12:37Security vs observability
- 15:52Security with system calls
- 18:23Linux Security Module interface
- 20:13BPF LSM example
- 23:06Alternative kernel hooks
- 24:51Tetragon runtime security
- 27:00Tetragon observability demo
- 30:53Blocking malicious activity
- 32:43eBPF security advantages
- 33:25Q&A session
related talks
40mExploring Runtime Security and Forensic using eBPF
36mPanel: Exploring eBPF Use Cases in Cloud-Native Security
43meBPF Superpowers for SRE
33meBPF for Security
32meBPF: The Next Power Tool of SREs
35mAn Introduction to eBPF - Superpowers for Networking, Observability & Security
53mGetting Started with BPF Security Observability
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools