Repository Index

Functional Network Framework for Multi-Core Architectures

LordOS — a free, fast and secure GNU/Linux distribution based on Debian, with its own desktop environment: display server and Wayland compositor in C, a React UI engine on QuickJS, and private native apps.

• c
• debian
• desktop-environment
• ebpf

Prototyping kernel development work outside mainline

• kernel-modules
• kernel
• xdp
• ebpf-programs

The Linux port of the Sysinternals Sysmon tool.

Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities

• ebpf
• security
• linux-kernel
• linux-security-module

🔍 Function-level tracing tool for Seccomp profiling, with eBPF

• ebpf
• ebpf-programs
• golang
• seccomp

bpflock - eBPF driven security for locking and auditing Linux machines

• bpf
• ebpf
• security
• lsm

Generic eBPF runtime

ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits

• linux
• security
• kernel
• rootkit

Red Canary's eBPF Sensor

• ebpf
• sensor
• edr-solutions

Contains materials for my technical presentation exploring Linux malware tradecraft—from userland and fileless techniques to kernel rootkits, ftrace, eBPF, and defensive strategies.

Sample BPF offload apps.

eBPF Information Flow Enforcement for AI Agent safety, security and effectiveness

• ebpf
• harness
• ifc
• policy-engine

Sample ebpf programs to analyze

• ebpf
• ebpf-programs
• ebpf-opcode

An EBPF based IPv4/IPv6 firewall with integrations for OpenZiti Zero-Trust Framework edge-routers and tunnellers

• ebpf
• ebpf-tc
• firewall
• ipv4

Jailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks processes using BPF task_storage maps and enforces role-based policies on file access, network operations, and process execution.

• bpf
• ebpf
• kernel
• linux

Sample project demonstrating how to use eBPF to encap/decap packets with an MPLS label.

• ebpf
• bpf
• linux
• linux-kernel-hacking

Zero-overhead eBPF process tracer for Linux malware triage and incident response. Traces syscalls, network, and file events per-process without strace overhead.

• bpf
• ebpf
• forensics
• golang

VALE eBPF extension module

An example of an eBPF program hooking into the kill tracepoint

eBPF-based pod-level kernel metrics collector for Kubernetes

• cgroup
• daemonset
• ebpf
• helm-chart

A joke IPX implementation for Linux using eBPF.