Starting eBPF

This repository is used to keep track of the programs I write while starting to learn about eBPF (Extended Berkeley Packet Filter) technology.

The main reference for this journey is the book Learning eBPF from Liz Rice, leveraging this book’s exercises and examples.

What is eBPF?

eBPF is a revolutionary kernel technology that allows developers to write custom code that can be loaded into the kernel dynamically, changing the way the kernel behaves.

This tool provides us the flexibility to build bespoke tools or customized policies. eBPF-based tools can observe any event across the kernel, and hence across all applications running on a (virtual) machine, whether they are containerized or not.

Just a few of the things you can do with eBPF include:

• Performance tracing of pretty much any aspect of a system;
• High-performance networking, with built-in visibility;
• Detecting and (optionally) preventing malicious activity.

Important

Because eBPF is continually evolving, the features available to you depend on the kernel version you’re running.

eBPF safety

Since eBPF programs can be loaded into and removed from the kernel dynamically, and a kernel code crash can potentially take down the machine and everything running on it, it’s important to have some guarantee that the code we’re using is correct to some extent.

With this in mind, the eBPF verifier was created. The eBPF verifier is the tool that ensure that an eBPF program is loaded only if it’s safe to run - it won’t crash the machine, or lock it up in a hard loop, and it won’t allow data to be compromised.

Vagrant

As you can notice by checking this repository, I added a Vagrantfile to make it easier to create a VM for testing purposes. This Vagrantfile is based on this reference from aquasecurity/tracee.

To start the server, you can do:

# the vagrant version I'm using
vagrant --version
# Vagrant 2.4.1

# =====================
# start the vm
vagrant up

# =====================
# connect to the vm through ssh
vagrant ssh

# =====================
# stop the vm
vagrant halt
# if you want to destroy the VM completely
# vagrant destroy

# =====================
# restart the vm
vagrant up

Helpers

bpf/bpf_helpers.h installation

I found the solution to this problem at this StackOverflow answer: link.

Basically, if you’re using a Linux distribution that uses apt as the package manager:

# update packages list
sudo apt update

# install libbpf-dev
sudo apt install libbpf-dev

# verify that it was installed
# check /usr/include/bpf/bpf_helpers.h

bpftool not found for kernel …

If this messages appears to you when trying to use the bpftool command, you can simply install it from the source, as explained at this comment: link.

rm /usr/sbin/bpftool

apt update && apt install -y git
cd / && git clone --recurse-submodules https://github.com/libbpf/bpftool.git

cd bpftool/src
make install

ln -s /usr/local/sbin/bpftool /usr/sbin/bpftool