Skip to content
Pitfalls of relying on eBPF for security monitoring (and some solutions)
blog.trailofbits.com | blog | #linux | #kernel | #ebpf | #trail-of-bits | #security-monitoring | #observability | #intrusion-detection
Summary
Trail of Bits details six pitfalls of using eBPF for Linux security monitoring—missed probes, data truncation, instruction limits, TOCTOU, event overload, page faults—and offers workarounds.
- Published
- Collected