Interactive eBPF

#1

Post by samuel246 » Fri, Jan 16, 2026, 8:01 AM UTC

Interactive eBPF
ebpf.party

Re: Interactive eBPF

#2

Post by deivid » Fri, Jan 16, 2026, 10:56 AM UTC

Thanks for sharing my site!

I've been thinking about building a platform like this for a while, and it was quite fun to build.

Let me know if you have questions or ideas for new exercises.

Re: Interactive eBPF

#3

Post by mattrighetti » Fri, Jan 16, 2026, 12:10 PM UTC

Nice, always wanted to get my hands on eBPF and this looks like a good way to try it out. Thanks!

Re: Interactive eBPF

#4

Post by self_awareness » Fri, Jan 16, 2026, 12:15 PM UTC

deivid wrote: post #2

Thanks for sharing my site! I've been thinking about building a platform like this for a while, and it was quite fun to build. Let me know if you have questions or ideas for new exercises.

This is really cool.

Are you planning to add "lessons" related to deployment? For example, using libbcc vs CO-RE?

Re: Interactive eBPF

#5

Post by 0x4a50 » Fri, Jan 16, 2026, 12:31 PM UTC

deivid wrote: post #2

Thanks for sharing my site! I've been thinking about building a platform like this for a while, and it was quite fun to build. Let me know if you have questions or ideas for new exercises.

Thanks for making this, looking forward trying it out!

Re: Interactive eBPF

#6

Post by deivid » Fri, Jan 16, 2026, 12:54 PM UTC

self_awareness wrote: post #4

deivid wrote: post #2

Thanks for sharing my site! I've been thinking about building a platform like this for a while, and it was quite fun to build. Let me know if you have questions or ideas for new exercises.

This is really cool. Are you planning to add "lessons" related to deployment? For example, using libbcc vs CO-RE?

I wanted to add all kind of exercises, but I'm not sure what's a good way of presenting a deployment exercise.

On libbcc specifically, I'm not sure it's worth it, CO-RE / BTF is where things are heading, and any reasonably new kernel supports it (<5 years old)

Re: Interactive eBPF

#7

Post by flipped » Fri, Jan 16, 2026, 3:35 PM UTC

For all it's innovative way of kernel programming, isn't eBPF a huge attack surface? Even a paradise for rootkit devs, perfectly able to hide using eBPF features.

Re: Interactive eBPF

#8

Post by natas » Fri, Jan 16, 2026, 5:47 PM UTC

@deivid I would certainly buy a pdf or book with this and more examples (with full source code).

Just a hint if you want to change the world and make a few bucks :)

Re: Interactive eBPF

#9

Post by razighter777 » Fri, Jan 16, 2026, 6:56 PM UTC

flipped wrote: post #7

For all it's innovative way of kernel programming, isn't eBPF a huge attack surface? Even a paradise for rootkit devs, perfectly able to hide using eBPF features.

Yes, but you need cap_bpf now to load ebpf programs.

Re: Interactive eBPF

#10

Post by shorden » Fri, Jan 16, 2026, 10:10 PM UTC

flipped wrote: post #7

For all it's innovative way of kernel programming, isn't eBPF a huge attack surface? Even a paradise for rootkit devs, perfectly able to hide using eBPF features.

Also worth noting that the verifier is under active development not only to verify more legitimate programs, but also to reject programs with exploits and side channels (and there are runtime defenses too, like dead code elimination and ALU sanitation).