3 ms·
Is there any advantages to bpf over the built in kernel auditing functionality i.e. https://wiki.archlinux.org/title/Audit_framework https://wiki.archlinux.org/
by nijave 3y ago
Is there any advantages to bpf over the built in kernel auditing functionality i.e. https://wiki.archlinux.org/title/Audit_framework https://wiki.archlinux.org/title/Audit_framework?
It'd if these types of things focused less on {performance, security, observability} and could just export data into whatever system you want.
- insanitybit 3y agoeBPF allows for some in-kernel logic, which can allow for filtering of data before it ever gets to userland. This can make it much faster than audit. eBPF is also much easier to extend with more complex logic since you can write near-arbitrary programs.
- nine_k 3y agoAlso eBPF does not seem to require a reboot with a special kernel parameter.
- openasocket 3y agoThe audit framework is less flexible in what you can get events for. eBPF gives you basically unlimited options, though you have to implement it yourself. Additionally the audit framework is wonky. There's the kernel side plus a userspace daemon that logs the audit data to disk. If you want to implement your own daemon to act as the audit agent, maybe to do something more sophisticated than just logging to disk, it gets complicated. There's very little documentation on how to implement such a custom daemon, you basically have to just copy what the existing agent does and hope you aren't subtly breaking things.