Tracing system calls with eBPF
a project by doreilly
Updated 5 months ago. 3 hacker ♥️. 2 followers.

Description

Many security tools need to record system calls like execve. Using the Linux audit system for this can have a detrimental performance impact in some cases.

Goals

The goal is to investigate eBPF as an alternative and do some benchmarking to see the impact and how it compares to using the audit subsystem.

Progress

BPF done - traceexec

Benchmark report

Resources

eBPF doc

libbpf

libMicro benchmark tool

Join this project

Looking for hackers with the skills:

bpf ebpf

This project is part of:

Hack Week 24

Activity

  • 5 months ago: alessio.biancalana liked this project.
  • 5 months ago: doreilly started this project.
  • 5 months ago: janvhs liked this project.
  • 5 months ago: doreilly added keyword "ebpf" to this project.
  • 5 months ago: doreilly added keyword "bpf" to this project.
  • 5 months ago: bmwiedemann liked this project.
  • 5 months ago: doreilly originated this project.


    • Comments

    • jiriwiesner
      5 months ago by jiriwiesner | Reply

      If I were to do this task the syscount script from bcc-tools would be my starting point: https://github.com/iovisor/bcc/blob/master/tools/syscount.py

    Similar Projects

    This project is one of its kind!