eBPF tracing fundamentals

Probes, maps, and the verifier.

eBPF is the technology that lets you run small, sandboxed programs inside the Linux kernel to observe (and sometimes act on) events as they happen — syscalls, network packets, file access, process execution — with very low overhead and without kernel modules. For security it is transformative: instead of polling state after the fact (like osquery) or parsing logs, an eBPF probe sees the event at the moment it occurs, in the kernel, where it is hardest for userland tricks to hide it. It is the engine under modern Linux runtime security tools.

The verifier: safety before power

The reason you can load a program into the kernel without the danger of a kernel module is the verifier: before an eBPF program is allowed to run, the kernel statically proves it is safe — it terminates (bounded loops, no infinite loops), it only accesses memory it is allowed to, and it cannot crash the kernel. Only a program that passes runs. This is what makes eBPF observation fundamentally safer than a kernel module: the module has the run of the kernel and can be a rootkit, while an eBPF program is constrained by the kernel itself before it ever executes.

From raw eBPF to security tools

You rarely write raw eBPF for security; you use tools built on it. The bcc and bpftrace projects let you write probes quickly (bpftrace is a one-line tracing language); Tetragon and Falco use eBPF to enforce and detect security policy; and observability platforms use it to trace everything a process does. The concept to carry forward is that eBPF gives you real-time, in-kernel, low-overhead event visibility — process executions, network connections, file opens — which is precisely the raw material the detection lessons turn into alerts.

# bpftrace: a one-liner that watches every process execution live (via an eBPF probe)
$ sudo bpftrace -e 'tracepoint:syscalls:sys_enter_execve { printf("%s -> %s\n", comm, str(args->filename)); }'
nginx -> /bin/sh          # a web server spawning a shell — exactly what you want to catch
# security tools (Falco, Tetragon) build on this to turn events into detections