Skip to main content Link Menu Expand (external link) Document Search Copy Copied
DevSecOps Guides

eBPF Security Checklist for DevSecOps

Table of contents

  1. Enable eBPF hardening
  2. Limit eBPF program load
  3. Restrict eBPF tracepoints access
  4. Use eBPF to monitor system calls
  5. Enable eBPF-based security monitoring
  6. Limit eBPF map operations
  7. Regularly update eBPF tools and libraries

List of some best practices to eBPF for DevSecOps

Enable eBPF hardening

echo 1 > /proc/sys/net/core/bpf_jit_harden

Limit eBPF program load

setcap cap_bpf=e /path/to/program

Restrict eBPF tracepoints access

echo 0 > /proc/sys/kernel/perf_event_paranoid

Use eBPF to monitor system calls

bpftrace -e 'tracepoint:raw_syscalls:sys_enter { @[comm] = count(); }'

Enable eBPF-based security monitoring

bpftool prog load secmon.bpf /sys/fs/bpf/

Limit eBPF map operations

bpftool map create /sys/fs/bpf/my_map type hash key 4 value 4 entries 1024

Regularly update eBPF tools and libraries

apt-get update && apt-get upgrade libbpf-tools