Search code examples
linuxebpf

Can eBPF call dynamic libraries?

Is it possible to write an eBPF program, that can dynamically call an external library? I.e. assume that this specific library is present on the host that runs the eBPF code.

Right now I don't care if the program is passing verification, but rather if it is possible to express this in the bytecode. It should be assumed that the external function is not embedded in the ELF binary.

Solution

  • No, this is not possible at the moment.

    Once loaded and attached, eBPF programs can call:

    • eBPF functions from the same program (eBPF-to-eBPF function calls)
    • other eBPF programs, under certain conditions, through tail calls
    • other eBPF programs of type BPF_PROG_TYPE_EXT
    • kernel function helpers (library of functions defined in the kernel)
    • random kernel functions, if they are explicitly marked as callable (should be in Linux 5.13)

    It cannot call functions from user space libraries.