// HACKER NEWS — CYBERSECURITY
Dropping eBPF CPU Cost by About 90% with Memoization (Not AI Gen)
My brother and I spent a lot of time designing our eBPF security agent to be really fast from the ground up, but recently we discovered we could make it much faster using memoization!
A couple of weeks ago, I profiled the eBPF code and found that the most expensive part of the protection isn’t actually enforcing a policy (allow/deny), but figuring out which policy applies to a given file open.
Our policies are path based, so our eBPF leverages an LSM hook that triggers on file open. We then reconstruct the path, walk up parent dentries, and check whether the file or any ancestor directory has a matching policy. While this works, it isn’t performant, and we end up repeating much of the work for files we have already seen (for example, database accesses that repeatedly reaccess file paths).
So, we cache which policy applies for each inode. This dropped our kernel CPU cost by about 90%.
Additionally, we recently open sourced our repo, so everything in this blog post can be found at https://github.com/bomfather/agent.
Before the cache, every file open would walk through the entire path. So the flow would look like this:
This works, but if the same file is opened multiple times or multiple files in the same subtree are opened, we have to repeat these steps for each file.
For example: In Postgres, if we only want Postgres to be able to touch /var/lib/postgres, we can have this example policy:
Then Postgres retrieves files from var/lib/postgres/data/base/123, var/lib/postgres/data/base/234, and var/lib/postgres/data/base/345. We would have to walk the entire path of dentries for each of these file accesses, which is really inefficient.
For the rest of this blog post, I’ll call this inefficient path walk “the slow path.”