In this lesson, you will learn how to leverage eBPF to observe and manipulate signal delivery across your system in real-time.
Previously, we explored how to audit signals using standard logs, but those methods often fall short when you need to see exactly who triggered a signal and what the kernel is doing just before it reaches the target process. eBPF (Extended Berkeley Packet Filter) allows us to hook directly into the kernel’s signal delivery path, providing an "insider’s view" that is both low-overhead and highly granular.
How eBPF Hooks Work
When a signal is sent—for example, when you run kill -9—the kernel executes specific internal functions like send_signal or do_tkill. By attaching an eBPF program to these kernel function entries (kprobes), we can intercept the signal data the moment it is generated.
Unlike traditional logging, eBPF allows us to look at the process context, the signal number, and even modify the behavior of the kernel function before it completes.
A Quick Example
Imagine you want to monitor whenever a SIGKILL is sent to a process. You could write a small eBPF script that attaches to send_signal:
SEC("kprobe/send_signal")
int BPF_KPROBE(send_signal, int sig, struct kernel_siginfo *info, struct task_struct *t) {
if (sig == SIGKILL) {
bpf_printk("SIGKILL detected targeting PID: %d\n", t->tgid);
}
return 0;
}
By hooking this function, your code executes every time any process tries to send a signal. Because this happens inside the kernel execution flow, you don't need to modify the target application or wait for a process-level audit trail to catch up.
This mechanism is essentially a "live wire" tapped into the kernel’s signaling infrastructure. It enables security observability tools to stop malicious signals or log rogue processes that attempt to terminate critical services, all without the performance bottlenecks associated with older tracing techniques.
Key Takeaway: eBPF provides a programmable, low-overhead way to inspect or intercept signal traffic at the kernel level by attaching probes directly to the kernel's internal signal-handling functions.