eBPF
also: BPF, Berkeley Packet Filter
eBPF (extended Berkeley Packet Filter) is a lightweight virtual machine embedded in the Linux kernel that allows unprivileged user-space programs to run sandboxed code safely in kernel space.
eBPF extends the original BPF technology to enable powerful, low-overhead instrumentation and monitoring of the Linux kernel. It provides a safer alternative to kernel modules by allowing code execution within the kernel while maintaining security boundaries through bytecode verification.
eBPF programs are compiled to bytecode, loaded into the kernel via system calls, and attached to various kernel hooks—such as network packets, system calls, or function entry/exit points. Common use cases include network packet filtering (as in tcpdump), performance profiling, and security monitoring.
Example: A BPF program can capture every open() system call made by a process without modifying kernel source code:
bpftrace -e 'tracepoint:syscalls:sys_enter_open { printf("%s %s\n", comm, args->filename); }'