you are viewing a single comment's thread
view the rest of the comments
[–] 11 points 1 week ago*

eBPF does run in kernel mode.

Maybe better than a module, but I wouldn't say "the kernel doesn't include any new code"

It's also why they have to use "integrity" mode of kernel lockdown

If they used "confidentiality" mode, their eBPF code would be untrusted by the kernel and couldn't be loaded

  • source
  • parent