Secure Deployment of eBPF Programs Made Manifest

eBPF allows for dynamic kernel customization at runtime with low overhead and fine-grained control over system operations. In recent years, its usage has increased in domains where performance is critical, including network management, system observability, and container security. However, the use of eBPF brings new challenges, particularly in development, security, and management, due to its complexity. To improve the use of eBPF, we propose a framework that packages signed eBPF bytecode along with a manifest and proof of logging in a transparency log. The manifest defines the permissions required for the eBPF program, giving a second verification level. Transparency logs can increase accountability because they show the entire lifecycle of a program, thereby holding administrators or developers accountable for their actions. We also suggest that every eBPF program must adhere to a local policy for security and compliance. This framework simplifies the deployment of eBPF while improving security, accountability, and compliance, making eBPF more accessible for widespread use in critical systems.