For all it's innovative way of kernel programming, isn't eBPF a huge attack surface? Even a paradise for rootkit devs, perfectly able to hide using eBPF features.
Also worth noting that the verifier is under active development not only to verify more legitimate programs, but also to reject programs with exploits and side channels (and there are runtime defenses too, like dead code elimination and ALU sanitation).
5 comments
[ 3.7 ms ] story [ 22.5 ms ] threadI've been thinking about building a platform like this for a while, and it was quite fun to build.
Let me know if you have questions or ideas for new exercises.
Just a hint if you want to change the world and make a few bucks :)