Rust and eBPF in the Linux kernel

In short: Since 2022 parts of the kernel may be written in Rust to avoid memory errors. With eBPF small safe programs can be loaded into the kernel at run time.

In more detail: About 70 percent of security vulnerabilities in the kernel come from memory errors in C. Rust prevents many of them at compile time.

In detail

• Rust: first code accepted in 6.1. Drivers (e.g. graphics) are being written in Rust. Developers disagree about the pace.
• eBPF: a virtual machine in the kernel. Programs are checked beforehand (verifier) and then run safely.
• Use: network filters (XDP), observability (bpftrace, Cilium, Falco), security, profiling.
• Advantages: change kernel behaviour without a new kernel or reboot.
• Tools: bpftrace, bcc, libbpf, perf.

See also: The Linux kernel at a glance, Kernel modules and drivers