eBPF: A Peek Inside the Linux Kernel Without Modifying It

If you wanted to know which process was opening a particular file, where a packet was dropped, or which kernel function was running slowly, you used to have to patch the kernel and then reboot. eBPF eliminates the need for that.

Core Idea

eBPF allows very small programs to be loaded into the kernel and attached to hooks: system calls, network events, and internal kernel functions. The program runs in a controlled virtual machine, and a verifier checks it before loading to ensure there are no infinite loops, no arbitrary memory access, and that the number of instructions is limited.

Thanks to that check, a faulty eBPF program will be rejected rather than causing the system to crash—unlike traditional kernel modules.

The three most widely used areas

• Monitoring: Measure latency for each system call, generate flame graphs, and track child processes—no need to modify the application
• Networking: Filter and route packets directly at the driver level, which is much faster than going through the entire network stack
• Security: Block system calls based on policies, log suspicious behavior at the kernel level

Try it right now on your computer

sudo apt install bpfcc-tools
sudo execsnoop-bpfcc      # mọi tiến trình mới sinh ra
sudo opensnoop-bpfcc      # mọi tệp được mở
sudo biolatency-bpfcc     # phân bố độ trễ ổ đĩa

Important Limitations

The verifier is quite finicky: complex programs are often rejected with cryptic error messages. Hooks into the kernel’s internal functions are also unstable across versions—if the kernel renames a function, your program breaks. For code intended to run for an extended period, you should rely on stable hooks rather than internal functions.