4 ms·
Note: At least on Linux the main alternatives for this, either eBPF (e.g., pulsar or falcon) or a kernel module, both require this too.
by c0balt 2y ago
Note: At least on Linux the main alternatives for this, either eBPF (e.g., pulsar or falcon) or a kernel module, both require this too.
- kelnos 2y agoeBPF is at least somewhat sandboxed, no? So it doesn't quite have the access required to accidentally stomp on any portion of kernel memory it wants?
- c0balt 2y agoIndeed it's executed via a Jit on something like a VM. However it can still, make your system quite disfunctional if, e.g., all filesystem or network calls are blocked.
- vel0city 2y agoThe version of the CrowdStrike sensor that caused kernel panics on RHEL/Rocky was using eBPF. It living in eBPF doesn't mean it can't cause system instability. And as mentioned elsewhere, an eBPF module behaving badly but in valid ways can still make your system pretty unusable.
- jen20 2y agomacOS does not require this however.