Security¶

Security posture of operating bpftrace: capability requirements, what tracing exposes, third-party script risk, and kernel hardening interactions. Privilege semantics follow documented kernel eBPF behavior; feature facts trace to upstream dependency_support.md and language docs verified August 2026.

Capability Model¶

bpftrace loads and attaches real BPF programs; every probe class therefore requires elevated privileges at runtime:

Capability	Needed for	Notes
`CAP_BPF` (5.8+)	program/map load via bpf() syscall	pairs with one of the below; alone insufficient for attach
`CAP_PERFMON`	kprobes, uprobes, tracepoints, sampling timers	replaces legacy `CAP_SYS_ADMIN` on modern kernels
`CAP_SYS_ADMIN`	pre-5.8 kernels and certain debugfs attach paths	still required in some distro/hypervisor combos
root	packaging default — sudo invocation as shown upstream docs	simplest correct posture

Check whether unprivileged BPF is disabled (hardened baseline; bpftrace assumes privileged operation anyway):

sysctl kernel.unprivileged_bpf_disabled

Container runtimes need explicit capability export (--privileged or targeted caps); namespace-confined root without perf/BPF grants fails at load, not at parse.

Data Exposure While Tracing¶

A tracing language is a data-exfiltration primitive by construction:

str(args.filename) prints filesystem paths — including tokens passed to open calls.
uprobe/USDT probes capture user-space function arguments: credentials buffers, request bodies, serialization inputs.
kretprobe histograms (hist(retval)) leak distributions that are themselves sensitive on multi-tenant hosts.

Operate bpftrace only on systems you own or are authorized to instrument. Incident-tooling usage should be governed by the same approvals as packet capture — same blast radius, different layer.

Third-Party Script Risk¶

.bt scripts look inert but compile to arbitrary-kernel-access programs under your privileges. Treat a borrowed script like a root shell:

Read every probe clause before running — check target functions match the claimed purpose.
Watch action bodies for unexpected writes or broad wildcards (kprobe:*-class matches instrument far more than needed).
Prefer vendoring community scripts into a reviewed repo over curl-piping from gists; treat updates as code review events.

The Clang front end accepts C preprocessor includes — complex upstream scripts can pull headers that materially change what they access, so review with expanded context (-d-style dry parsing exists precisely for this audit step).

Kernel Hardening Interactions¶

Hardened hosts intentionally restrict what bpftrace needs; expect friction and document exceptions rather than loosening globally:

Lockdown integrity mode commonly gates debugfs/tracing interfaces several providers depend on (CONFIG_DEBUG_FS=y is on the required list).
secureBoot + signed-module policies may block unsigned BPF loads depending on distribution policy hooks.
Vendor kernels (cloud images, LTS-minus builds) frequently ship with CONFIG_KPROBE_EVENTS or CONFIG_UPROBE_EVENTS off — the readiness grep lives in Operations.
auditd/seccomp profiles for service accounts will see unusual bpf() syscall traffic when agents run; allowlist deliberately.

For permanent fleet deployment prefer purpose-built daemons compiled against libbpf over ad-hoc bpftrace sessions — smaller privilege surface, reviewed binaries, no scripting interpreter present on hosts.

Overhead as an Availability Concern¶

Aggressive probing is a self-inflicted outage vector on busy systems. Mitigations grounded in documented mechanics:

Keep hit-path actions minimal; lean on PERCPU map aggregation instead of per-event user-space wakeups.
Drain maps on slow intervals asynchronously (print(@) consumer pattern from the stdlib docs) — sync CPU iteration inside hot clauses is explicitly flagged expensive.
Sample (profile, ms-scale interval:) rather than record when the question tolerates estimation.
Cap concurrency of parallel sessions; overlapping full-kernel kprobes multiply already-paid costs.

Lifecycle Hygiene¶

Ctrl-C tears down attached programs, but crashed sessions can strand resources. After abnormal exits:

sudo bpftool prog show && sudo bpftool map show

Standalone bpftrace rarely pins objects persistently; residue most often appears when wrapping automation kills sessions mid-load.

Questions¶

Do hardened distros (Fedora lockdown defaults, Ubuntu FIPS profiles) ship turnkey "trace-ops" role definitions mapping bpftrace needs to exact capabilities?
What policy linting exists for .bt review — static checks for wildcard breadth, sync-read anti-patterns, or PII-shaped argument access?