Runtime Security

eBPF for Security Monitoring: What It Can and Cannot Do

eBPF is being called the future of security observability. It is genuinely powerful, but it is not a magic bullet for runtime security.

Michael
Security Architect
5 min read

eBPF (extended Berkeley Packet Filter) has become one of the most talked-about technologies in the security monitoring space. It lets you run sandboxed programs in the Linux kernel without modifying kernel source code or loading kernel modules. For security teams, this means deep visibility into system behavior without the performance overhead and stability risks of traditional approaches.

But the marketing around eBPF often outpaces the reality. Understanding what eBPF actually provides and where it falls short is essential for making informed decisions about your security monitoring stack.

What eBPF Actually Does

eBPF programs attach to kernel hooks, tracepoints, and function entry/exit points. They can observe system calls, network packets, file operations, process execution, and virtually any kernel event. The data they collect can be aggregated, filtered, and sent to userspace for analysis.

The key constraint is that eBPF programs are verified by the kernel before they run. The verifier ensures they terminate, do not access invalid memory, and do not compromise kernel stability. This makes eBPF significantly safer than kernel modules but also limits what eBPF programs can do.

System Call Monitoring

eBPF can intercept every system call made by every process. This provides visibility into file access patterns, network connections, process creation, and privilege escalation attempts. Unlike userspace monitoring tools that rely on log parsing, eBPF sees the system calls directly and cannot be bypassed by a process that avoids logging.

Network Observability

eBPF programs can inspect network packets at multiple points in the kernel networking stack. This enables protocol-aware monitoring without the performance overhead of packet capture. You can track DNS queries, HTTP requests, and TLS handshakes at the kernel level.

For container environments, eBPF network monitoring provides per-pod or per-container network visibility without requiring changes to application code or network configuration.

File Integrity Monitoring

By attaching to file operation hooks, eBPF can monitor every file read, write, open, and delete on the system. This enables real-time file integrity monitoring that detects modifications to critical system files, configuration changes, and data exfiltration attempts.

Process Execution Monitoring

eBPF tracks process creation, execution, and termination. It can observe the full process tree, including parent-child relationships, command line arguments, and environment variables. This is invaluable for detecting unexpected process execution in containers, where the expected process set is well-defined.

Security Use Cases

Container Runtime Security

eBPF is particularly well-suited for container security because containers share the host kernel. A single eBPF program on the host can monitor all containers without requiring any agent inside the containers. This eliminates the need for sidecar containers or in-container security agents.

eBPF-based container security tools can enforce policies like: this container should only execute /app/server, should only connect to ports 443 and 5432, and should only read files in /app/data. Any deviation from the expected behavior triggers an alert or is blocked.

Detecting Cryptominers

Cryptocurrency miners are a common payload for container compromises. eBPF can detect mining activity through multiple signals: unexpected process execution, high CPU utilization patterns, connections to mining pool IP addresses, and system calls associated with mining software.

Privilege Escalation Detection

eBPF can monitor for system calls associated with privilege escalation: setuid, setgid, capability changes, and namespace manipulation. When a process in a container that should be running as a non-root user attempts to escalate privileges, eBPF can detect and block the attempt.

Lateral Movement Detection

By monitoring network connections at the kernel level, eBPF can detect unexpected lateral movement between pods, nodes, or network segments. A database pod that suddenly initiates SSH connections to other nodes is a strong indicator of compromise.

Limitations

Kernel Version Requirements

eBPF features are tied to kernel versions. The most useful security features require kernel 4.18 or later. Some advanced capabilities require 5.x kernels. If your environment runs older kernels, eBPF capabilities will be limited.

Performance Overhead

eBPF is efficient but not free. Programs that monitor high-frequency events, like network packet processing or file system operations on busy systems, add measurable overhead. The overhead is typically small (single-digit percentage CPU) but can be significant in performance-sensitive workloads.

Complexity

Writing and maintaining eBPF programs requires specialized knowledge of kernel internals. While high-level tools abstract much of this complexity, debugging eBPF-based security issues requires understanding of the underlying kernel mechanisms.

Bypass Techniques

eBPF monitors the kernel interface, but sophisticated attackers can use techniques that avoid triggering monitored hooks. Return-oriented programming, direct memory manipulation, and exploitation of kernel vulnerabilities can potentially bypass eBPF monitoring.

No Retrospective Analysis

eBPF provides real-time monitoring. It does not provide retrospective analysis of what happened before the monitoring was in place. You need log retention and forensic capabilities alongside eBPF monitoring.

eBPF Security Tools

Cilium Tetragon

Tetragon provides runtime security observability using eBPF. It monitors process execution, network connections, and file access with low overhead and high fidelity. It integrates with Kubernetes and provides policy enforcement capabilities.

Falco With eBPF Driver

Falco uses either a kernel module or an eBPF driver to monitor system calls. The eBPF driver provides the same detection capabilities with better stability and easier deployment.

KubeArmor

KubeArmor uses eBPF and LSM hooks to enforce security policies on Kubernetes pods. It can restrict process execution, file access, and network connections based on configurable policies.

How Safeguard.sh Helps

Safeguard.sh complements eBPF-based runtime security by providing the pre-deployment analysis that runtime tools cannot. While eBPF monitors what happens at runtime, Safeguard.sh identifies vulnerabilities and supply chain risks before containers are deployed. Together, they provide defense in depth: Safeguard.sh catches known vulnerabilities and supply chain issues during the build and deploy phases, while eBPF tools catch exploitation attempts and anomalous behavior at runtime.

Never miss an update

Weekly insights on software supply chain security, delivered to your inbox.