eBPF security
Using eBPF for security monitoring + enforcement. Tetragon, Falco, Cilium network-policy, BPF-LSM. Modern alternative to traditional kernel modules (KSM) that required signed binary, hard-to-deploy.
eBPF-LSM (Linux Security Module via eBPF, kernel 5.7+): write LSM policies in eBPF, dynamically loaded, no kernel recompile. Use cases: container runtime-security, syscall filtering (better than seccomp for complex policies), network-policy enforcement. Modern security vendors: CrowdStrike, SentinelOne, Wiz, Sysdig — all use eBPF for kernel visibility. The eBPF verifier ensures no kernel crash. Performance overhead: 1-5% typical. Distinct from traditional EDR: kernel-native, no agent bloat, container-aware. Modern-Linux-security default direction.