feat: add kernel basics blog #771

paularah · 2025-09-16T12:47:43Z

No description provided.

netlify · 2025-09-16T12:47:49Z

✅ Deploy Preview for cilium ready!

Name	Link
🔨 Latest commit	`15a8c6d`
🔍 Latest deploy log	https://app.netlify.com/projects/cilium/deploys/68d053ba1e1ec3000890227c
😎 Deploy Preview	https://deploy-preview-771--cilium.netlify.app
📱 Preview on mobile	Toggle QR Code... Use your smartphone camera to open QR code link.

To edit notification comments on pull requests, go to your Netlify project configuration.

netlify · 2025-09-16T12:47:49Z

👷 Deploy Preview for cilium processing.

Name	Link
🔨 Latest commit	`9bad600`
🔍 Latest deploy log	https://app.netlify.com/projects/cilium/deploys/68c95c722e3dac000844db1d

xmulligan · 2025-09-17T05:34:05Z

package-lock.json

Is there a reason you are updating this in the PR? Should it be separate?

src/posts/2025-09-16-kernel-basics-for-tetragon/index.md

Signed-off-by: Paul Arah <[email protected]>

xmulligan · 2025-09-17T10:32:46Z

src/components/pages/enterprise/training/training.jsx

I think you pulled this in by mistake?

Yes, that was a mistake, but I think its fine. It's the same as the main branch.

The main branch doesn't have it anymore

we removed it in #753

Signed-off-by: Paul Arah <[email protected]>

doniacld · 2025-09-17T11:51:46Z

src/posts/2025-09-16-kernel-basics-for-tetragon/index.md

+
+**_Author: Paul Arah, Isovalent@Cisco_**
+
+![](cover.png)


I find it difficult starting to read a blog post with a diagram, not sure what should I focus on and if I should come back later after reading. Maybe add a bit a context we will come back to it or move it later in the article.

doniacld · 2025-09-17T11:52:34Z

src/posts/2025-09-16-kernel-basics-for-tetragon/index.md

+
+When you write Tetragon tracing policies, you’re not writing arbitrary sets of rules; you're programming against the kernel execution path itself. Every policy you create hooks directly into kernel functions, intercepts system calls, and examines kernel data structures. This power comes with responsibility. Without an understanding of how the Linux kernel works, you'll find yourself writing policies that are ineffective, overly broad, or worse, missing the exact events you are trying to find.
+
+This blog is meant to be a pointer guide; it won’t make you a kernel hacker overnight, but it aims to cover some core Linux knowledge essential for crafting effective Tetragon tracing policies. We’ll connect kernel fundamentals such as user vs. kernel space, system calls, process structures, namespaces, and more to practical tracing policy examples. A basic familiarity with Linux and a base-level understanding of what Tetragon is will be enough to follow along.


This blog post? I am not the best at writing english so if it's not correct do not consider my comment 😇

doniacld · 2025-09-17T11:53:05Z

src/posts/2025-09-16-kernel-basics-for-tetragon/index.md

+
+One of the most fundamental concepts in Linux system programming is the distinction between kernel space and user space.
+
+**User space** is where apps like Bash, Nginx, VS Code run. Userspace programs run with restricted privileges and cannot do things like access arbitrary memory locations, execute privileged instructions, directly control hardware, or access kernel data structures.


I would start with the foundation the kernel space, the foundation like in the section title.

doniacld · 2025-09-17T11:53:23Z

src/posts/2025-09-16-kernel-basics-for-tetragon/index.md

+
+Most programming languages offer some sort of standard library that provides a high-level abstraction over the system call interface; this way, application developers typically never have to access the system call interface directly. When you write tracing policies, we’re working with the kernel’s perspective, where syscalls are the actual events being invoked.
+
+![](syscall.png)


Kernel space should be in a box too?

doniacld · 2025-09-17T12:00:03Z

src/posts/2025-09-16-kernel-basics-for-tetragon/index.md

+- **Kprobes** provide dynamic probes on almost any kernel function. They let you intercept functions like `fd_install()` whenever they’re called. Kprobes are powerful, but are tightly coupled with your kernel version since kernel functions can change across versions.
+- **Tracepoints** are essentially built-in static markers inside the kernel. For example, `sched_process_exec` fires every time a process runs a new program. Tracepoints are more stable than kprobes and work across kernel versions.
+- **Uprobes** are like kprobes, but for user-space programs. For example, you can hook into the readline() function in Bash to see when someone types a command.
+- **BPF LSM** essentially allows instrumenting Linux Security Module (LSM) hooks at runtime. A good way to think of LSM hooks is as some kind of built-in checkpoint that asks, “Is this action allowed?” before letting a process do something sensitive. Security systems like SELinux or AppArmor use LSM hooks. Tetragon can also use LSM hooks for access control and observability. LSM hooks are reliable, less prone to race conditions like TOCTOU, and always represent real enforcement points.


TOCTOU is also mentioned later and the full name is displayed maybe switch here and mention only TOCTOU after.

src/posts/2025-09-16-kernel-basics-for-tetragon/index.md

Co-authored-by: doniacld <[email protected]> Signed-off-by: Paul Arah <[email protected]>

paularah requested review from doniacld and xmulligan September 16, 2025 21:14