Hacker News Reader

Don't disagree, but there are eBPF mitigations that work as alternatives to unloading kernel modules.

Can you elaborate on that?

Have a look at https://github.com/atgreen/rhel-block-copyfail

Thanks!

From the sound of it, the same mitigations for Copy Fail 1 are also effective here.

No, they are different. I just bundled them together for convenience in this POC. The only real thing in common is that they both use eBPF.

Got it, thanks!

I was aware of commercial antivirus vendors (Crowdstrike) doing something like this, but this is the first I've seen it published by somebody in the open!

Have you considered writing up a blog post and submitting this to HN?

Reply on news.ycombinator.com