I understood it is mainly used for observability (ie read-only).
I saw you can route packets, but can you do more than that?
Can you also manipulate the file system, send signals and write from an eBPF program?
-
Regarding "and write from an eBPF program?", what do you mean by this? Write where?– pchaignoSep 28, 2022 at 9:20
Add a comment
|
2 Answers
What are the limitations of eBPF feature-wise?
That's a very broad question :-) To get an idea of what eBPF can do, you can have a look at the official website: https://ebpf.io.
Except maybe for interactions with the filesystem (see below), it's hard to think of something eBPF programs can't do today.
Can you also manipulate the file system, send signals and write from an eBPF program?
Manipulate the file system: Except for the sysctls (see the bpf_sysctl_set_new_value BPF helper), I don't believe you can write to files from BPF programs today. I think it's mostly that a use case hasn't come up for that.
Send signals: You can send signals using the bpf_send_signal BPF helper.
-
-
I think that's still very broad unfortunately. A kernel module can do a lot that eBPF programs can't. As far as I understand, a kernel module could for example attach to a function and change the register at entry or exit. On the other hand, it can also crash the kernel with invalid memory accesses, unaligned accesses, infinite loops, etc.– pchaignoSep 28, 2022 at 13:24
eBPF is by design not able to make any call into the kernel it wants. They create "bpf helpers" function which are the capabilities of the kernel that are exposed to ebpf programs. you can see the list here:
https://github.com/torvalds/linux/blob/master/include/uapi/linux/bpf.h#L1538
