efee22

4 ms·

1. 1.▲
   by efee22 2y ago

   It's not a silver bullet, however, it is still better to pushing all the panicable bugs into one community-maintained section (e.g. eBPF verifier). All vendors have an incentive to help get right and this is much better than every vend
2. 2.▲
   by efee22 2y ago

   Infinite loops are not possible and would get rejected by the verifier since it cannot solve the halting problem. Here is a good overview on the options available: https://ebpf-docs.dylanreimerink.nl/linux/concepts&#x2F
3. 3.▲
   by efee22 2y ago

   RHEL kernel.. right. Imho, I'd trust an upstream stable kernel far more than a RHEL one for production which has dozen of feature backports and an internal kABI to maintain.. granted RH has a QA team, but it is still impossible to test
4. 4.▲
   by efee22 2y ago

   Agree, Crowdstrike was an unlucky one, but it is more about the issue in general. If I remember correctly, also others like sysdig user their own kernel modules for collection.
5. 5.▲
   by efee22 2y ago

   I think with a LTS distribution you should get very far these days when it comes to implementing such sensors.