Linux kernel / bpf / attach points / enforcement

Where an eBPF Program Attaches Decides Whether It Can Say No

The misconception

That eBPF is one capability you turn on, so any eBPF tool can see and block anything. A tracepoint's return value is discarded — it is a notification and nothing else. A kprobe on an internal function can only change the outcome through bpf_override_return, which needs CONFIG_BPF_KPROBE_OVERRIDE, must sit at function entry, and only works on functions a kernel developer explicitly added to the error-injection whitelist; none of the functions on the ordinary exec, open, connect or write paths are on it. A BPF LSM program is the one that returns a decision the kernel obeys — and even there, 54 of the 277 LSM hooks return void, so attaching to one of those buys observation too. The failure mode is believing a tracing tool is blocking when it is only watching, or reaching for a SIGKILL and not noticing that sched_process_exec fires after begin_new_exec, which the kernel's own comment calls the point of no return.

15 min

An eBPF program's return value is only a decision if the kernel code that called it is written to consume one, so what a program can observe and whether it can change the outcome are both fixed by the attach point, and the useful question about any attach point is where it sits relative to the moment the action becomes irreversible.

The lesson that sent you here

Kernel Enforcement Cannot See Intent
That putting Tetragon or Falco under an agent contains it, because eBPF sees everything and blocks in-kernel at microsecond latency. Coverage really is that good and the block really does hold. The gap is semantic: the hook sees an outbound connection to an allowed address, not that a prompt injection caused it or that the bytes are rows from a table the agent was never meant to query. Because a legitimate agent's paths, hosts and processes drift prompt to prompt, a learned allowlist is either loose enough to contain the attacker's primitives too or tight enough to break the agent — and the settings in between shrink to nothing as that drift grows. The designs that work concede this by construction: they use eBPF to see and to redirect, and put the decision at a layer that has the nouns — an L7 proxy, a per-agent identity, a network policy, an admission rule. The cost of not knowing that is a control that is trusted, correct, and produces no security.

1 published lesson depends on this concept, which is what moves it up the writing queue. Nothing is hidden behind this page — it has not been written.

Read first

This lesson assumes them.

The eBPF Verifier Rejects Correct Programs
Before asking what an attach point lets a program decide, you need the load-time proof, because the attach point also decides which helpers exist and what the context pointer contains.

Go next

Where this leads.

Kernel Enforcement Cannot See Intent
This lesson is what a hook can decide; that one is whether the arguments it decides on carry enough meaning to separate legitimate work from an attack.

Referenced by

Lessons that link here.

Kernel Enforcement Cannot See Intent
What an attach point can observe versus decide, and where the decision lands relative to the effect. This lesson assumes that mechanism and asks what the decision can be about.

Why this concept is on the site

Topics are chosen from places engineers visibly get stuck, and the sources are kept with the lesson so the claim is checkable.

The project most people have read about states its own limit: "a SIGKILL sent in a write() system call does not guarantee that the data will not be written to the file", and "To ensure the operation is not completed, though, the Signal action should be combined with the Override action."docs · primary source: Tetragon Enforcement, read directly 2026-08-22
States the stability trade directly — "Because kernel functions might change across versions, kprobes are highly tied to your kernel version" against "Tracepoints are statically defined in the kernel and have the advantage of being stable across kernel versions" — and the time-of-check to time-of-use warning about pointer arguments, with the LSM hook as the fix.docs · primary source: Tetragon hook points, read directly 2026-08-22
The kernel's own BPF LSM page, whose worked example returns -EPERM from an lsm/file_mprotect program — the only attach class in this lesson whose return value the kernel acts on.docs · primary source: Documentation/bpf/prog_lsm.rst at Linux v7.2
perf_event_attach_bpf_prog() refuses with -EINVAL unless the probe is on function entry and the function is error-injectable, with the comment "Kprobe override only works if they are on the function entry, and only if they are on the opt-in list."github · primary source for the override gate, read at v7.2
Explains why the opt-in list is short: a candidate must "not execute any code which can change any state before the first error return", which excludes almost every function worth blocking at.docs · primary source: Documentation/fault-injection/fault-injection.rst at Linux v7.2
exec_binprm() emits trace_sched_process_exec() after search_binary_handler() has run load_binary(), and begin_new_exec() is prefaced by the comment "Calling this is the point of no return" — so the tracepoint every tool uses for exec events fires after the process has already become the new binary.github · primary source for the exec ordering, read at v7.2
277 LSM hooks, of which 54 are declared LSM_HOOK(void, LSM_RET_VOID, ...) — attaching a BPF program to one of those gets observation, and kernel/bpf/bpf_lsm.c refuses to give it a return-value range at all.github · primary source for the hook table, read at v7.2
"block/drop Socket in ebpf hooking at syscall tracepoint 'sys_enter_connect' and 'sys_enter_bind'" — the misconception stated as a question: someone trying to enforce at an attach point whose return value is thrown away.stackoverflow · 447 views, 1 answer
"bpf_override_return not working with uretprobes" — four votes and no answer, because the helper's constraints are in a comment in bpf_trace.c and nowhere a user would look.stackoverflow · 4 votes, 377 views, 0 answers
The same question asked a second time by someone else, which is what a badly-documented constraint looks like in the data.stackoverflow · 713 views, 2 answers
"eBPF vs non-eBPF tracepoint/kprobes" — 2,108 views on the question of what the attach point actually is, separately from what eBPF is.stackoverflow · 2 votes, 2,108 views, 2 answers
Someone hunting for a hook that both knows what they need and sits early enough to act on it — the search this lesson is about, asked before BPF LSM existed.stackoverflow · 12 votes, 1,051 views, 1 answer