I'd recommend to anyone running Linux that they do exactly that - disable unprivileged eBPF. For a server you shouldn't need that, you can just drop privs for y

I'd recommend to anyone running Linux that they do exactly that - disable unprivileged eBPF. For a server you shouldn't need that, you can just drop privs for your service after setting up the filter. They should probably put it behind its own capability like CAP_LOAD_EBPF. Forcing signed ebpf will also help though.