Kernel-Resident Regex and Jails: DFA-powered eBPF filtering and certificate...
summary
Compiles regexes to DFAs and runs them in-kernel via eBPF at LSM and fentry to achieve no-emit security, cutting user-space filtering and I/O; integrates with BpfJailer and MetArmor for certificate, executable and DNS enforcement across hosts. Uses a regex→AST→DFA pipeline, represents DFAs in BPF maps, and exposes runtime variable values via BPF maps for context-aware matching. Prototype limits current DFAs to small state counts (≈64), supports a reduced regex feature set, shows measurable CPU savings, and targets open source in 2026.
AI-written summary · about
chapters (12)
- 0:00Introduction and motivation
- 1:06AI agents and privilege escalation risks
- 3:39Runtime context in FSM file matching
- 6:49Why regex in eBPF
- 8:35Performance benefits of kernel regex
- 11:42NFA to DFA conversion theory
- 13:24Regex parsing and fragment conversion
- 15:30BPF maps for DFA representation
- 17:57eBPF regex matching implementation
- 20:06Challenges with DFA state limits
- 22:15Future optimizations and open source plans
- 23:24Q&A on state limits and optimizations
related talks
32meBPF: The Next Power Tool of SREs
36meBPF for Runtime Security
42mResolving Performance and Security Issues with eBPF
40mExploring Runtime Security and Forensic using eBPF
33meBPF: exploring use case of BPF kernel infrastructure
43meBPF Superpowers for SRE
28mBeyond Power and Magic: Forging Stable eBPF Tools for the Post-Demon King Era
29meBPF on the Rise - Getting Started