Understanding where eBPF programs attach is essential for designing security instrumentation. Different hook types offer different capabilities and trade-offs.
The Major Hook Types for Security
kprobes / kretprobes: Attach to the entry or return of any kernel function by name. Extremely flexible — you can hook tcp_connect, vfs_open, do_execve, or any other kernel function. The downside: kernel function names and signatures can change between kernel versions, making kprobe-based tools potentially fragile across upgrades.
Tracepoints: Stable, versioned hook points that kernel developers explicitly maintain across releases. Examples: syscalls/sys_enter_execve, net/net_dev_xmit. Preferred over kprobes when a tracepoint exists for your use case because they're guaranteed stable.
LSM (Linux Security Module) hooks: Attach to the kernel's security decision points — the same hooks used by SELinux and AppArmor. These hooks support enforcement: your eBPF program can return a non-zero value to deny the operation. This is the foundation of tools like Tetragon's enforcement mode.
XDP (eXpress Data Path) and TC (Traffic Control): Network-layer hooks that fire before the kernel's networking stack processes a packet. Used for high-performance packet filtering, DDoS mitigation, and network policy enforcement (Cilium uses this for Kubernetes network policy).
uprobe / uretprobe: Attach to user-space function entry/return — including functions inside shared libraries like libssl. This is how Tetragon can trace which TLS functions were called inside a process without modifying the application.
Key Point: The choice of hook type determines whether your tool can detect or prevent. kprobes and tracepoints are observe-only — your program runs after the fact or in a non-enforcement context. LSM hooks are the correct mechanism for synchronous enforcement. Many tools (including Falco in kernel module mode) historically used kprobes for detection; Tetragon's enforcement capability relies on LSM BPF hooks, which require Linux 5.7+. Always check your kernel version before deploying enforcement-capable eBPF security tools.