Speaker
Description
RV is a lightweight method for verifying system behavior at runtime using, for instance, deterministic automata. Currently, RV monitors must be implemented in-kernel, meaning any new monitor requires going through the upstream kernel development process.
We can replicate the existing monitor infrastructure in BPF mapping kernel primitives to BPF equivalents such as maps and ring buffers, while reusing common logic where possible.
This allows to develop, test, and deploy domain-specific monitors entirely from userspace, with all the perks of the BPF tracing infrastructure.
In the talk we will cover an implementation using BPF struct_ops for mostly seamless integration with the in-kernel RV framework and tools, BPF monitor lifecycle control via the rv command line tool (i.e. registration, activation, and tracing), and various tradeoffs to keep a similar experience between different monitor implementations.