A book-in-progress about the Linux kernel and its insides.
Repository Index
47,133 repositories indexed
1–9 of 9 · Most stars
LKM rootkit for Linux Kernels 2.6.x-7.x (x86/x86_64 and ARM/ARM64)
ebpfkit is a rootkit powered by eBPF
Sigma Rules Engine inside the Linux Kernel using eBPF. Focusing on prevention capabilities
ebpfkit-monitor is a tool that detects and protects against eBPF powered rootkits
Jailer is an eBPF-based process jailing system that provides mandatory access control (MAC) for Linux. It tracks processes using BPF task_storage maps and enforces role-based policies on file access, network operations, and process execution.
Cross-compile the Linux kernel for Raspberry Pi with enhanced security in a single command.
Open-source eBPF compatibility evidence and CI gate
A modular Linux telemetry engine built with eBPF, libbpf CO-RE, and Modern C++ that captures kernel-level process, file, syscall, and network events through a portable event-processing pipeline for decoding, enrichment, filtering, and structured output—forming the foundation for higher-level runtime intelligence.