Tracing the Linux kernel with eBPF and Rust
summary
Explains how eBPF runs in-kernel, shows eBPF programs in Rust with Aya and bpf-rs, and describes building Exein Pulsar: an eBPF-based security observability framework that embeds precompiled BPF into a user app, uses maps for kernel↔user communication, XDP for packet filtering, and a Tokio-based manager to load/unload models. Demonstrates a type-safe DSL for rules that match events (file opens, network packets), notes resource limits on small devices and verifier restrictions.
AI-written summary · about
chapters (18)
- 0:00eBPF and Rust introduction
- 1:36IoT security challenges
- 5:13eBPF vs user-space logging
- 7:55BPF to eBPF history
- 10:47eBPF in Linux kernel
- 13:33eBPF safety and limits
- 14:58eBPF portability with BTF
- 16:53Rust for eBPF libraries
- 17:17Demo setup overview
- 20:35Building eBPF program
- 23:37eBPF producer-consumer model
- 26:30Kernel data access
- 29:11User-space eBPF maps
- 30:57eBPF virtual module
- 33:22Event filtering demo
- 37:10eBPF documentation
- 39:03eBPF on resource limits
- 40:58Q&A
related talks
36mRust in the Kernel (via eBPF)
48mInto the hive of eBPF!
32mExploring the Power of eBPF for System Observability
32meBPF: The Next Power Tool of SREs
31meBPF 101
38mLinux Kernel Tracing Using eBPF
38mThe Next Linux Superpower: eBPF Primer
40mPanel Discussion: eBPF: A New Era in Cloud Infrastructure Tools