Learning eBPF

Chapter 9. eBPF for Security

You’ve seen how eBPF can be used to observe events across a system and report information about those events to user space tools. In this chapter you’ll consider how to build on the concept of event detection to create eBPF-based security tools that can detect, or even prevent, malicious activity. I’ll start by helping you understand what makes security different from other types of observability.

Note

Example code for this chapter is in the GitHub repo in the chapter9 directory.

Security Observability Requires Policy and Context

The difference between a security tool and an observability tool that reports on events is that a security tool needs to be able to distinguish between events that are expected under normal circumstances and events that suggest malicious activity might be taking place. For example, suppose you have an application that writes data to a local file as part of its normal processing. Let’s say the app is expected to write to /home/<username>/<filename>, so this activity isn’t something you’re interested in from a security perspective. However, you would want to be notified if the app writes to one of the many sensitive file locations in Linux. For example, it is unlikely that it needs to modify the password information stored in /etc/passwd.

Policies have to take into account not just normal behavior when systems are fully functional, but also the expected error path behavior. For example, if a physical disk gets full, the application ...