eBPF (extended Berkeley Packet Filter) is a virtual machine that can be used to run custom programs inside the Linux kernel. It is a powerful tool that allows low-level system operations to be performed without modifying the kernel itself. This is achieved via the sandboxed eBPF VM that verifies and safely runs the program inside the Linux kernel. eBPF does to Linux what JavaScript does to web browsers. eBPF enables the dynamic addition of new functionality or instrumentation to the Linux kernel without modifying it. This book will teach you to write eBPF programs in Rust that will be compiled to run directly inside the Linux kernel.

To ease the learning curve, the book is divided into two parts. The first part will cover the basics of the eBPF Virtual Machine (VM), the VM instruction set, eBPF maps, and eBPF program types. The first part will also cover the setup required to run an eBPF Rust program and the tools required to debug eBPF programs.

The book's second part will perform a thorough code walkthrough of several eBPF programs covering topics such as adding new instrumentation and modifying kernel behavior. The sample programs included cover topics such as

• Tracepoints
• kprobes (Kernel probes)
• uprobes (User Space probes)
• Socket filters
• XDP (eXpress Data Path)
• LSM (Linux Security Module)
• Traffic Control Classifier

These programs will be implemented in Rust using the aya-rs library.