News for hackers. Stuff that matters.
Re:eBPF – Adding functionality to OS at runtime to achieve p... by mdaverde on Sunday November 06, 2022 @07:28PM (#33499415)
In the near term with a recent-enough BTF-enabled kernel, bpftool should be enough for an "ambitious" user to understand what objects are being run on a system.

Unfortunately, "ambitious" here meaning enough to actually understand more than just what eBPF is but also the significance of each hook, what effect the bpf program has (most eBPF programs are GPL-licensed), and which processes have access to these objects.

This is not easy, especially considering that the shape of eBPF changes with each kernel release.

There are no comments on this comment yet.