cyber.hendryadrian.com
Security Insights · wiz.io

How eBPF Enables Low-Overhead Linux Security Observability

· Original article ↗

Summary

An explainer introduces eBPF as a sandboxed alternative to kernel modules and demonstrates a basic tracer, highlighting its potential for low-overhead security and system observability.

Key points

  • Kernel modules can introduce stability and maintenance risks; the article presents eBPF as a more constrained alternative.
  • The article describes eBPF programs as sandboxed and subject to verifier checks, including limits on pointers, stack size, loops, and helper functions.
  • Security observability examples include identifying unusual process input, connections to known crypto-mining domains, and attempts to access /etc/passwd.
  • The walkthrough uses BCC and Python to compile an eBPF program and attach it to the execve syscall through a kprobe.
  • The example requires Linux kernel version 4.4 or later; the author demonstrates it on Ubuntu 22.04 with kernel 5.15.
  • The article says BPF-based tracing can have less overhead than using strace to monitor system calls.

Article Details

Topic
eBPF technology and its applications in cloud-native security observability, monitoring, and networking

People

Brendan D. GreggSoftware engineer and eBPF expert cited for comparing eBPF to JavaScript in HTML.

Products

Kubernetesand microservices signifies a departure from traditional monolithic approaches. Within this landscape, Kubernetes has emerged as the primary orchestrator for managing cloud-native applications, embodying theMicrosoft's eBPF for Windowsbe enabled. The applicability of eBPF will also broaden due to cross-platform support, like Microsoft's eBPF for Windows project. As eBPF gains momentum, it will likely integrate more deeply with existingUbuntufrom the bpf() syscall. The bare minimum kernel version required is 4.4. In my case, I’m running 5.15 on Ubuntu 22.04: 

Tools

BCCTo continue, we'll need to get bcc installed. The BCC project can be found at BCC project. The instructions for installing BCC are available here, and it offers a user-friendly interface for compiling and loading eBPFStraceAs system administrators, we are familiar with the benefits of using strace as a tool to monitor system calls. However, it is important to note that this command can create a significant amount of overhead when

Related Articles