--- title: Preventing Data Exfiltration with eBPF | daily.dev description: Explains how Kernel Runtime Security Instrumentation (KRSI), combining Linux Security Module hooks with eBPF, can be used to dynamically prevent data... canonical: https://daily.dev/posts/preventing-data-exfiltration-with-ebpf-jg1keapo3 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: Preventing Data Exfiltration with eBPF | daily.dev og:description: Explains how Kernel Runtime Security Instrumentation (KRSI), combining Linux Security Module hooks with eBPF, can be used to dynamically prevent data... og:url: https://daily.dev/posts/preventing-data-exfiltration-with-ebpf-jg1keapo3 og:image: https://api.daily.dev/og/posts/jG1kEAPo3.png og:image:alt: Preventing Data Exfiltration with eBPF og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # Preventing Data Exfiltration with eBPF **[Teleport](https://daily.dev/sources/teleport)** · 8 min read · 0 upvotes · 0 comments ## Summary Explains how Kernel Runtime Security Instrumentation (KRSI), combining Linux Security Module hooks with eBPF, can be used to dynamically prevent data exfiltration by enforcing IP-based deny lists at the socket connect() level. Walks through writing an eBPF LSM hook in C that checks connection attempts against a BPF trie map of denied CIDR ranges, then pairs it with a Go userspace daemon using libbpfgo to load the program and update the deny list at runtime. Ends by noting Teleport's upcoming Restricted Sessions feature in Teleport 7.0 uses this same KRSI approach to apply network policies to SSH sessions across a fleet via a gRPC API. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### How can I use eBPF to dynamically block outbound connections to specific IP ranges on Linux? You can implement an LSM hook using eBPF's Kernel Runtime Security Instrumentation (KRSI) attached to the socket_connect() call. The eBPF program checks the destination address against a BPF LPM trie map storing denied CIDR ranges, returning -EPERM if a match is found. A userspace daemon written in Go with the libbpfgo library loads the program and updates the trie map at runtime without needing a restart. _Developers building runtime network policies with eBPF can find implementation deep-dives like this via daily.dev._ ### What is KRSI in the Linux kernel and how does it relate to eBPF and LSM? Kernel Runtime Security Instrumentation (KRSI) is a Linux kernel technology, merged by Google, that lets developers implement Linux Security Module (LSM) hooks using eBPF programs. LSM hooks are code paths throughout the kernel used by tools like AppArmor and SELinux for security decisions; KRSI lets custom eBPF code attach to these hooks and be updated dynamically via BPF maps instead of requiring static configuration. _Security engineers tracking new kernel-level enforcement mechanisms like KRSI can follow updates on daily.dev._ ### How do you structure a BPF LPM trie map to store CIDR ranges for IP matching in an eBPF program? Define a struct with a 32-bit prefixlen field followed by a 32-bit IP address as the map key, and declare the map with type BPF_MAP_TYPE_LPM_TRIE, max_entries set appropriately, and the BPF_F_NO_PREALLOC flag. The value type can be a placeholder like char since only the presence of a matching prefix matters. This lets an eBPF program perform longest-prefix-match lookups against a userspace-managed deny list. _Engineers designing kernel-level IP filtering logic can dig into eBPF map patterns like this through daily.dev._ ## Similar posts on daily.dev - [Understanding Kubernetes Network Security](https://daily.dev/posts/understanding-kubernetes-network-security-i5js8crfk) · cilium · 4 upvotes · 0 comments - [How eBPF Empowers Developers to Observe Inside the Linux Kernel in a Safe and Unintrusive Way](https://daily.dev/posts/how-ebpf-empowers-developers-to-observe-inside-the-linux-kernel-in-a-safe-and-unintrusive-way-jhmpnwjer) · InfoQ · 0 upvotes · 0 comments - [How GitHub uses eBPF to improve deployment safety](https://daily.dev/posts/how-github-uses-ebpf-to-improve-deployment-safety-pvedlou4r) · GitHub Blog · 1 upvotes · 0 comments - [Hardening eBPF for runtime security: Lessons from Datadog Workload Protection](https://daily.dev/posts/hardening-ebpf-for-runtime-security-lessons-from-datadog-workload-protection-luuhfraro) · eBPF · 6 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#linux](https://daily.dev/tags/linux), [#golang](https://daily.dev/tags/golang) [View this post on daily.dev](https://daily.dev/posts/preventing-data-exfiltration-with-ebpf-jg1keapo3) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"Preventing Data Exfiltration with eBPF","url":"https://daily.dev/posts/preventing-data-exfiltration-with-ebpf-jg1keapo3","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/preventing-data-exfiltration-with-ebpf-jg1keapo3"},"datePublished":"2026-08-23T12:23:06.508Z","dateModified":"2026-08-23T12:52:07.146Z","description":"Explains how Kernel Runtime Security Instrumentation (KRSI), combining Linux Security Module hooks with eBPF, can be used to dynamically prevent data...","image":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","thumbnailUrl":"https://media.daily.dev/image/upload/s--1KxV4ohY--/f_auto/v1722860400/public/Placeholder%2007","isAccessibleForFree":true,"articleSection":"Teleport","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Teleport","logo":"https://media.daily.dev/image/upload/s--Dw-Bbw6O--/c_limit,w_256/f_auto,q_auto/v1787487494/logos/teleport?_a=BAMAMicg0","url":"https://daily.dev/sources/teleport"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/preventing-data-exfiltration-with-ebpf-jg1keapo3","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,linux,golang","timeRequired":"PT8M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Teleport","item":"https://daily.dev/sources/teleport"},{"@type":"ListItem","position":3,"name":"Preventing Data Exfiltration with eBPF"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/preventing-data-exfiltration-with-ebpf-jg1keapo3#faq","mainEntity":[{"@type":"Question","name":"How can I use eBPF to dynamically block outbound connections to specific IP ranges on Linux?","acceptedAnswer":{"@type":"Answer","text":"You can implement an LSM hook using eBPF's Kernel Runtime Security Instrumentation (KRSI) attached to the socket_connect() call. The eBPF program checks the destination address against a BPF LPM trie map storing denied CIDR ranges, returning -EPERM if a match is found. A userspace daemon written in Go with the libbpfgo library loads the program and updates the trie map at runtime without needing a restart. Developers building runtime network policies with eBPF can find implementation deep-dives like this via daily.dev."}},{"@type":"Question","name":"What is KRSI in the Linux kernel and how does it relate to eBPF and LSM?","acceptedAnswer":{"@type":"Answer","text":"Kernel Runtime Security Instrumentation (KRSI) is a Linux kernel technology, merged by Google, that lets developers implement Linux Security Module (LSM) hooks using eBPF programs. LSM hooks are code paths throughout the kernel used by tools like AppArmor and SELinux for security decisions; KRSI lets custom eBPF code attach to these hooks and be updated dynamically via BPF maps instead of requiring static configuration. Security engineers tracking new kernel-level enforcement mechanisms like KRSI can follow updates on daily.dev."}},{"@type":"Question","name":"How do you structure a BPF LPM trie map to store CIDR ranges for IP matching in an eBPF program?","acceptedAnswer":{"@type":"Answer","text":"Define a struct with a 32-bit prefixlen field followed by a 32-bit IP address as the map key, and declare the map with type BPF_MAP_TYPE_LPM_TRIE, max_entries set appropriately, and the BPF_F_NO_PREALLOC flag. The value type can be a placeholder like char since only the presence of a matching prefix matters. This lets an eBPF program perform longest-prefix-match lookups against a userspace-managed deny list. Engineers designing kernel-level IP filtering logic can dig into eBPF map patterns like this through daily.dev."}}]} ```