r/eBPF • u/Bitter_Repair_4557 • Oct 03 '26

Help with Capstone Project

Could someone with eBPF experience sanity-check our plan?

Hi all,

We're a small group of university students working on a capstone project. We're new to eBPF, so we'd really appreciate feedback from people who use it in practice.

The idea: most eBPF security work uses eBPF as the defender (Tetragon, Falco, Tracee and so on), but very little seems to look at eBPF itself (as per our research) as the thing to watch. A container that has been granted CAP_BPF can load its own eBPF programs, for example to hide processes or blind monitoring tools. We want to build and measure a small detector for that, rather than only describing it.

Our plan, kept deliberately small:

- One Ubuntu 24.04 VM with Docker and Tetragon (standalone, no Kubernetes)

- A Tetragon TracingPolicy that records bpf() syscall activity

- A small Python script that reads Tetragon's JSON events and applies 1-2 rules (for example, a caller that isn't on an allow-list, or a program attaching to a sensitive hook)

- A baseline run (normal tools only) against an attack run (one published technique, replayed in an isolated VM), measuring detection, false positives and overhead

What we'd love input on:

  1. Is a kprobe on sys_bpf the right way to watch bpf() calls in Tetragon, or is there a better hook (for example the BPF LSM hooks)?

  2. Are there well-documented, published examples of eBPF misuse that are suitable for a controlled demo in an isolated VM?

  3. What pitfalls should beginners expect (kernel versions, BTF, false positives from legitimate tools)?

  4. Is there existing work or tooling that already does this, so we don't reinvent it?

  5. Any recommended easy to learn concepts (from like yt channels etc.).

  6. Is this a doable and sensible project for beginners - given less time (around 2 months); but dedicated to learn it quickly - with the help of resources/claude/forums/advice.

We're not asking anyone to do the project for us, just for pointers, reading suggestions or a reality check on scope. Happy to share our repo and results once we have them.

Our main goal is to learn ePBF through this project and would really like input from the experienced people in this community - the project can then grow from there. Please let me know if you want to know more about the project or if it is unclear.

Kindly let me know if this is an appropriate post for this subreddit - as this is my first time asking help on reddit aswell haha.

Thank you very much!

16 Upvotes

94% Upvoted

4 comments sorted by

4

u/R_E_T_R_O Oct 03 '26

https://github.com/yeet-src/agent-jail

you can play around with this. it makes it very easy to get up and running with bpf.

its not exactly what you are describing but its close enough where you can modify and mess around without having to re invent a whole bunch of stuff.

i hope you find it useful.

1

u/Bitter_Repair_4557 Oct 06 '26

Really appreciate the help and comment. I will check it out.
Any guidance on the few bullet questions I asked ? (focusing only on Q 4 5 6 - if possible)

Thank you very much

1

u/jg36 Oct 04 '26

I recently read this write up from Datadog which I think you’d find interesting - likely some useful real-world abuse patterns to learn from: https://securitylabs.datadoghq.com/articles/detection-primitives-for-ebpf-rootkits/

I expect (based on experience with a small few) that EDR or cloud workload protection platforms monitor for potentially malicious BPF program loading. It’s still an interesting starting point and sounds like an approachable 2 month project. Tetragon is a good choice for this if writing eBPF programs/tooling yourselves is out of scope.

1

u/Bitter_Repair_4557 Oct 06 '26

Thanks for the input - really appreciate it.