存储结 构存储数据，能通过 map 同用户态程序交互， 最终实现内核数据进行修改，或者影响内核处 理请求的结果，或者改变内核处理请求的流程。 极大提升了内核处理事件的效率。 截止 linux 5.14 版本，eBPF 有32种类型程序。而 cilium 主要使用了如下类型程序： • sched_cls 。cilium在内核 TC 处实现数据包转发、负载均衡、过滤 • xdp 。cilium在内核 XDP

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ the door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocat Door override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAcce Successfully set AccessCode to 999 Securing Access to a gRPC

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

the public terminal can properly act as a client to the door service. We can test this by running a Python gRPC client for the door service that exists in the terminal-87 container. We’ll invoke the ‘cc_door_client’ door-id): $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetName 1 Door name is: Spaceport Door #1 $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py GetLocation override the security and help the rebels escape. To see this, run: $ kubectl exec terminal-87 -- python3 /cloudcity/cc_door_client.py SetAccessCode 1 999 Successfully set AccessCode to 999 Securing Access

process confinement from the ground up. 3 / 7 bpfbox Implementation ▶ Userspace daemon using the Python3 bcc framework ▶ Kernelspace components are all eBPF ▶ LSM probes (KRSI), kprobes, uprobes, tracepoints

#/home/manashuk/Documents# kernel.pid_max = 4194304 [1]+ Done sysctl kernel.pid_max root@ubuntu:/home# python breakpoint.py 0xffffffffaa2623b0 -1 3 Kernel Stack : scan_block scan_gray_list kmemleak_scan kmemleak_scan_thread