2 Prerequisites This skill 0 Unlocked

Skill · Linux · Trace and harden the kernel with eBPF

Restrict and audit eBPF on a server: block unprivileged loading, delegate CAP_BPF, harden the JIT and inventory loaded programs

Reduce the risk eBPF adds to a server: block loading by unprivileged users, delegate CAP_BPF instead of root, harden the JIT compiler, then inventory loaded programs to spot a rootkit.

Start lesson 1The Linux domain

• 3 lessons
• ~1 h 55 of reading
• 3 quizzes
• 0 proof lab

The path

Where it comes from, where it leads

What you need to know first, where you stand on this skill, and what it opens next. Your status is computed in your browser, from what you have read and passed.

Before · 2 prerequisites

• Harden the running kernel: persistent sysctl parameters and blocked modules
• Limit and isolate a process with cgroups, namespaces and capabilities

Recommended before · 1

• Trace the Linux kernel live with bpftrace: choose a probe, write a one-liner and aggregate into counters and histograms

This skill, for you

Restrict and audit eBPF on a server: block unprivileged loading, delegate CAP_BPF, harden the JIT and inventory loaded programs

Computing

It unlocks · nothing yet

No other skill requires it: it is an end-of-path skill.

Lessons

How to learn it

3 lessons, about ~1 h 55, in program order. Each lesson ends with its quiz.

The program

3 lessons · ~1 h 55

1. 1La surface d'attaque d'eBPF (in French)· 45 min
2. 2Rootkits eBPF, la menace et sa détection (in French)· 20 min
3. 3Durcir eBPF sur un serveur (in French)· 50 min

Beyond the lessons

Assess, practise, pass the proof

Reading a lesson confirms nothing. A skill is confirmed by a passed quiz, practised in a guided lab, and put to the test by a challenge or a mission; an imported lab result is not verified by the site.

Assess yourself

3 quizzes

At the end of the lessons: passed at 70%, they confirm the skill.

Practice

2 guided labs

• Harden eBPF with sysctl: block unprivileged users and make it stick across reboots
• Inventory the loaded eBPF programs with bpftool and stop the service that carries one

Proof

No proof

Neither a challenge nor a mission with a proof yet.

Around it

Who requires it, who teaches it

Required by

• Linux Administrator

Taught by

• Linux Training

Same block · Trace and harden the kernel with eBPF

• Trace the Linux kernel live with bpftrace: choose a probe, write a one-liner and aggregate into counters and histograms

×

See in the glossary →