Hacker News Reader

> psc uses eBPF iterators to read process and file descriptor information directly from kernel data structures. This bypasses the /proc filesystem entirely, providing visibility that cannot be subverted by userland rootkits or LD_PRELOAD tricks.

Is there a trade off here?

View on HN

I found this justification dubious. To me the main reason to use eBPF is that it gives more information and is lower overhead.

It requires root

Running eBPF programs doesn't strictly require root.

It requires cap_bpf which is considered a high privileged capability.

So yes, it requires root in the sense of what people mean by root.

You can also enable unpriviledged ebpf.

Reply on news.ycombinator.com