When Kernel Programmers Lie to the Verifier: A Tale of Broken Assumptions in eBPF
The Failing Guard Imagine you are a system administrator tasked with a simple security policy: block and log any attempt to execute binaries from the /tmp directory. After some research, you settle on the eBPF Linux Security Module (eBPF LSM). It’s the perfect tool for the job—it allows you to hook into the execve path, inspect the filename and arguments, and decide whether to allow the execution.…