• ozymandias117@lemmy.world
    link
    fedilink
    English
    arrow-up
    8
    ·
    edit-2
    23 hours ago

    eBPF does run in kernel mode.

    Maybe better than a module, but I wouldn’t say “the kernel doesn’t include any new code”

    It’s also why they have to use “integrity” mode of kernel lockdown

    If they used “confidentiality” mode, their eBPF code would be untrusted by the kernel and couldn’t be loaded