Why eBPF? The End of TOCTOU

The Old Way: System Call Auditing (ptrace / auditd)

Traditional security tools monitor applications from user space. They intercept system calls using mechanisms like ptrace (used by strace, debuggers, and older security agents) or the kernel's auditd subsystem.

The fundamental problem: these tools observe events after the kernel has already processed them, or they require expensive context switches between kernel mode and user mode for every intercepted event. This creates two serious issues:

Performance: Every intercepted system call requires the CPU to switch from kernel mode to user mode (to run the security agent), then back to kernel mode to resume the application. On a database making tens of thousands of system calls per second, this overhead is measurable and significant — often 10–30% CPU overhead for high-frequency workloads.

TOCTOU (Time of Check to Time of Use): This is a class of race condition attack that user-space monitoring is structurally vulnerable to.

Here's how a TOCTOU attack works in practice:

1. A process calls open("/tmp/safe_file.txt", O_RDONLY).
2. The user-space security agent intercepts the call, checks the path, and decides it's safe. It signals "allow."
3. In the microseconds between the agent's approval and the kernel actually executing the open(), the attacker's code runs rename("/tmp/safe_file.txt", "/tmp/backup"); symlink("/etc/shadow", "/tmp/safe_file.txt").
4. The kernel opens /etc/shadow — the attacker's target — because the path was already approved.

The security check and the actual operation are two separate moments in time. The gap between them is the vulnerability.

The eBPF Way

eBPF programs run inside the kernel, attached directly to the kernel function being called. There is no gap. When an eBPF program attached to sys_openat runs, it executes as part of the kernel's processing of that system call — synchronously, before the operation completes.

If the eBPF program decides to block the operation (using a hook type that supports enforcement, like LSM hooks or seccomp with eBPF), the kernel function aborts immediately. The attacker's rename trick doesn't work because there's no window between check and use — they happen atomically within the same kernel execution context.