Sysarmor Metas eBPF Security Detection and Enforcement Tool
summary
Sysarmor is an eBPF security daemon deployed across collocated hosts, Meta Network Appliances, development servers, cloud gaming and AWS/GCP that evaluates rules inside BPF and can enforce them via BPF‑LSM. It runs over 50 BPF hooks (networking, privilege escalation, rootkits, containers), filters ~99.999% of events in-kernel to keep probe latency in the low hundreds of ns, streams detections to an offline pipeline for automated or manual remediation (file acquisition, network block, process stop), and tackles hard problems like collecting executable and container metadata with uprobes and BPF iterators.
AI-written summary · about
chapters (11)
- 0:00Introduction to Sisarmor
- 1:23Problem statement and goals
- 2:49Sisarmor features and architecture
- 5:38Detection use cases overview
- 8:10Performance optimization strategies
- 10:58Tracking user activity in sessions
- 15:36Monitoring Python scripts
- 19:54Challenges with file paths
- 24:52Key challenges and solutions
- 32:47Working with file paths in BPF
- 35:18Acknowledgments and closing
related talks
25mProtecting Modern Workloads with eBPF superpowers
32mReal Time Security - eBPF for Preventing attacks
07mLightning Talk: Armoring Cloud Native Workloads with BPF LSM
36meBPF for Runtime Security
34mChoose Your Shield: Evaluating Linux Security Modules for Cloud Na...
21mArmoring Cloud Native Workloads With LSM Superpowers
28mKubeArmor: Applying Security Policies with Practical Examples in K8S
32mBpfJailer: eBPF based Mandatory Access Control