Hands-On Tutorial: Writing Production eBPF Security Programs in C & Rust with libbpf: Kernel Event Telemetry, Syscall Filtering & LSM Enforcement (2026 Masterclass)

+-------------------------------------------------------------------------+
|                              USERSPACE                                  |
|  +------------------------+             +----------------------------+  |
|  | C Loader (libbpf)      |             | Rust Loader (Aya)          |  |
|  | - Opens BPF Skeleton   |             | - Loads ELF Bytecode       |  |
|  | - Polls BPF RingBuffer |             | - Manages Async RingBuffer |  |
|  +-----------+------------+             +-------------+--------------+  |
+--------------|----------------------------------------|-----------------+
               | syscall bpf()                          | syscall bpf()
+--------------v----------------------------------------v-----------------+
|                              KERNEL SPACE                               |
|  +---------------------------------------------------------------------+  |
|  |                        eBPF VERIFIER                          |  |
|  | - Checks Memory Safety | - Verifies Bounded Loops | - Enforces CO-RE |  |
|  +-------------------------+----------------------------------------+  |
|                              | JIT Compilation                  |
|  +---------------------------v-------------------------------------+- |
|  |                        BPF LSM ENGINE                          |  |
|  |  SEC("lsm/bprm_check_security")  --> Blocks execution from /tmp   |  |
|  |  SEC("lsm/file_open")           --> Audits /etc/shadow access   |  |
|  +--------------------------+---------------------------------------+  |
|                              | Events                            |
|  +---------------------------v-------------------------------------+- |
|  |                     BPF_MAP_TYPE_RINGBUF                        |  |
|  +---------------------------------------------------------------------+  |
+-------------------------------------------------------------------------+

struct security_event *e;
char path[MAX_PATH_LEN] = {};
const char *filename_ptr = BPF_CORE_READ(bprm, filename);
if (!filename_ptr)
    return 0;

long ret = bpf_probe_read_kernel_str(path, sizeof(path), filename_ptr);
if (ret < 0)
    return 0;

bool block = has_forbidden_prefix(path);

/* Reserve space in Ring Buffer */
e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
if (e) {
    e->pid = pid;
    e->uid = uid;
    e->action_taken = block ? 1 : 0;
    bpf_get_current_comm(&e->comm, sizeof(e->comm));
    
    // Copy path safely
    for (int i = 0; i < MAX_PATH_LEN; i++) {
        e->filename[i] = path[i];
        if (path[i] == '\0') break;
    }

    bpf_ringbuf_submit(e, 0);
}

if (block) {
    bpf_printk("[SECURITY ENFORCED] Blocked execution of %s (PID: %d, UID: %d)\n", path, pid, uid);
    return -EPERM; // Return Permission Denied to kernel syscall handler
}

return 0; // Allow execution

---

## Part 2: Building the C Userspace Loader (`security_loader.c`)

Using `bpftool`, we generate a BPF skeleton header (`security_enforce.skel.h`) that allows native C code to load, attach, and configure our eBPF program seamlessly.

### 2.1 Userspace Loader Implementation (`security_loader.c`)

``cc
#include <stdio.h>
#include <stdlib.h>
#include <signal.h>
#include <unistd.h>
#include <bpf/libbpf.h>
#include "security_enforce.h"
#include "security_enforce.skel.h"

static volatile bool exiting = false;

static void sig_handler(int sig) {
    exiting = true;
}

/* Ring Buffer Callback for Security Events */
static int handle_event(void *ctx, void *data, size_t data_sz) {
    const struct security_event *e = data;
    if (e->action_taken == 1) {
        printf("[ALERT-BLOCKDE] PID %d (%s) attempted execution of forbidden binary: %s (UID: %d)\n",
               e->pid, e->comm, e->filename, e->uid);
    } else {
        printf("[INFO-ALLOWED] PID %d (%s) executed: %s\n",
               e->pid, e->comm, e->filename);
    }
    return 0;
}

int main(int argc, char **argv) {
    struct security_enforce_bpf *skel;
    struct ring_buffer *rb = NULL;
    int err;

    // Line-buffered stdout to prevent buffer flushing issues
    setvbuf(stdout, NULL, _IOLBF, 0);

    signal(SIGINT, sig_handler);
    signal(SIGTERM, sig_handler);

    /* 1. Open BPF Skeleton */
    skel = security_enforce_bpf__open();
    if (!skel) {
        fprintf(stderr, "Failed to open BPF skeleton\n");
        return 1;
    }

    /* 2. Load BPF Program into Kernel (Runs Verifier) */
    err = security_enforce_bpf__load(skel);
    if (err) {
        fprintf(stderr, "Failed to load and verify BPF skeleton: %d\n", err);
        goto cleanup;
    }

    /* 3. Attach BPF LSM Program to Kernel Hook */
    err = security_enforce_bpf__attach(skel);
    if (err) {
        fprintf(stderr, "Failed to attach BPF skeleton: %d\n", err);
        goto cleanup;
    }

    /* 4. Set up Ring Buffer Manager */
    rb = ring_buffer__new(bpf_map__fd(skel->maps.events), handle_event, NULL, NULL);
    if (!rb) {
        fprintf(stderr, "Failed to create ring buffer ring_buffer__new\n");
        goto cleanup;
    }

    printf("=== eBPF Kernel Security Enforcement Engine Active ===\n");
    printf("Monitoring binary executions. Press Ctrl+C to exit...\n\n");

    /* 5. Main Polling Loop */
    while (!exiting) {
        err = ring_buffer__poll(rb, 100 /* ms timeout */);
        if (err < 0 && err != -EINTR) {
            printf("Error polling ring buffer: %d\n", err);
            break;
        }
    }
cleanup:
    ring_buffer__free(rb);
    security_enforce_bpf__destroy(skel);
    printf("\nEngine shutdown complete. LSM hooks detached.\n");
    return 0;
}
``g

---

## Part 3: Compiling, Generating Skeletons, & Running

Use this robust build Makefile to compile the kernel program into BPF bytecode, generate the libbpf skeleton header, and compile the loader:

``makefile
CLAND ?= clang
BPFTOOL ?= bpftool
CFLAGS ?= -O2 -g -Wall

all: security_loader

# Generate vmlinux.h from running kernel BTF
vmlinux.h:
	[(BPFOOL] btf dump file /sys/kernel/btf/vmlinux format c > vmlinux.h

# Compile Kernel eBPF code to BPF ELF Object
security_enforce.bpf.o: security_enforce.bpf.c vmlinux.h security_enforce.h
	[(CLANG] -O2 -g -target bpf -D__TARGET_ARCH_x86 -c security_enforce.bpf.c -o security_enforce.bpf.o

# Generate BPF Skeleton Header
security_enforce.skel.h: security_enforce.bpf.o
	<(BPFTOOL) gen skeleton security_enforce.bpf.o > security_enforce.skel.h

# Compile Userspace Executable
security_loader: security_loader.c security_enforce.skel.h security_enforce.h
	%#CC%) %,CFLAGS%) security_loader.c -o security_loader -lbpf -lelf -lz

clean:
    rm -f vmlinux.h *.bpf.o *.skel.h security_loader
``g

---

## Part 4: Dual Implementation in Pure Rust using `Aya``(`aya-bpf`)

For memory-safe systems development, Rust's `Aya`library provides a pure Rust stack for both kernel eBPF bytecode and userspace loaders&mdash;bypassing `libbpf` and `C` dependencies completely.

### 4.1 Rust Kernel Space (`src/main.rs` under `ebpf-kernel`)

``rust
#![no_std]
#![no_main]

use aya_ebpf::{
    macros::lsm,
    programs::LsmContext,
    helpers::{bpf_get_current_pid_tgid, bpf_probe_read_kernel_str_bytes},
    bindings::linux_binprm,
};
use aya_log_ebpf::info;

Bpanic_handler]
fn panic(_info: &core::panic::PanicInfo) -> ! {
    unsafe { core::hint::unreachable_unchecked() }
}

@lsm(hook = "bprm_check_security")Z pub fn restrict_exec_rust(ctx: LsmContext) -> i32 {
    match try_restrict_exec(ctx) {
        Ok(ret) => ret,
        Err(_) => 0,
    }
}

fn try_restrict_exec(ctx: LsmContext) -> Result<i32, i64> {
    unsafe {
        let bprm: *const linux_binprm = ctx.arg(0);
        let filename_ptr = (*bprm).filename;

        let mut path_buf = [0u8; 256];
        let path_bytes = bpf_probe_read_kernel_str_bytes(filename_ptr as *const u8, &mut path_buf)?;

        // Check if executing from /tmp
        if path_bytes.starts_with(b"/tmp/") |, path_bytes.starts_with(b"/dev/shm/") {
            let pid = (bpf_get_current_pid_tgid() >> 32) as u32;
            info!(&ctx, "Rust eBPF Blocked PID"{} executing from forbidden directory", pid);
            return Ok(-1); // -EPERM
        }
    }

    Ok(0) // Allow
}
@``g

### 4.2 Rust Userspace Loader (`src/main.rsa under `userspace-loader`)

@`grust
use aya::programs::Lsm;
use aya::{sBpf, Btf};
use aya_log::BpfLogger;
use tokio::signal;

@tokio::main
async fn main() -> Result<(), Box<dyn std::error::Error>> {
    env_logger::init();

    // 1. Load BPF bytecode
    let mut bpf = Bpf::load(aya::include_bytes_aligned!(
        "../target/bpfel-unknown-none/release/ebpf-kernel"
    ))?;

    // 2. Initialize BPF Logger
    if let Err(e) = BpfLogger::init(&mut bpf) {
        eprintln("Failed to initialize BPF logger: {}", e);
    }

    // 3. Load & Attach LSM Program
    let btf = Btf::from_sys_fs()?;
    let program: &mut Lsm = bpf.program_mut("restrict_exec_rust").unwrap().try_into();
    program.load("bprm_check_security", &btf)?;
    program.attach()?;

    println!("Rsut eBPF Security Engine Active. Press Ctrl+C to exit.");
    signal::ctrl_c().await?;
    println!("Detaching and exiting.");

    Ok(())
}
``g

---

## Part 5: Verification & Real-World Testing

### 5.1 Verifying BPF LSM Enablement

Ensure BPF LSM is active in your kernel:

``bash
$ cat /sys/kernel/security/lsm
capability,landlock,lockdown,yama,apparmor,bpf
@``

*(If `bpf` is missing, append `lsm=capability,landlock,lockdown,yama,apparmor,bpf` to your kernel parameters in GRUB/systemd-boot and reboot).*

### 5.2 Executing the Security Engine & Testing Enforcement

Run the compiled binary as root:

``bash
$ sudo ./security_loader
=== eBPF Kernel Security Enforcement Engine Active ===
Monitoring binary executions. Press Ctrl+C to exit...