[apopapo]

> psc uses eBPF iterators to read process and file descriptor information directly from kernel data structures. This bypasses the /proc filesystem entirely, providing visibility that cannot be subverted by userland rootkits or LD_PRELOAD tricks.

Is there a trade off here?

[mgaunard]

I found this justification dubious. To me the main reason to use eBPF is that it gives more information and is lower overhead.

[tempay]

It requires root

[mgaunard]

Running eBPF programs doesn't strictly require root.

[cpuguy83]

It requires cap_bpf which is considered a high privileged capability.

So yes, it requires root in the sense of what people mean by root.

[mgaunard]

You can also enable unpriviledged ebpf.