{"id":16333078,"url":"https://github.com/fzakaria/rust-ebpf-demo","last_synced_at":"2026-04-15T16:02:39.755Z","repository":{"id":140112469,"uuid":"218387633","full_name":"fzakaria/rust-ebpf-demo","owner":"fzakaria","description":"A simple pure hello world demo of writing an ebpf filter in rust","archived":false,"fork":false,"pushed_at":"2019-10-29T21:55:01.000Z","size":3,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":3,"default_branch":"master","last_synced_at":"2024-12-26T14:12:03.823Z","etag":null,"topics":["ebpf","ebpf-programs","linux","linux-kernel","rust"],"latest_commit_sha":null,"homepage":null,"language":"Rust","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":null,"status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/fzakaria.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":null,"code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null}},"created_at":"2019-10-29T21:32:53.000Z","updated_at":"2022-04-14T11:03:30.000Z","dependencies_parsed_at":null,"dependency_job_id":"8b694234-7d04-4cb1-8c8e-1d0d14a1d650","html_url":"https://github.com/fzakaria/rust-ebpf-demo","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fzakaria%2Frust-ebpf-demo","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fzakaria%2Frust-ebpf-demo/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fzakaria%2Frust-ebpf-demo/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/fzakaria%2Frust-ebpf-demo/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/fzakaria","download_url":"https://codeload.github.com/fzakaria/rust-ebpf-demo/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":239303099,"owners_count":19616662,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["ebpf","ebpf-programs","linux","linux-kernel","rust"],"created_at":"2024-10-10T23:34:14.554Z","updated_at":"2025-11-01T16:30:31.467Z","avatar_url":"https://github.com/fzakaria.png","language":"Rust","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Rust eBPF Hello World\n\nThis is a **minimal** example of how to write an eBPF filter in rust **natively**.\nThis \"hello-world\" draws on a lot of inspiration from [this blog post](http://unhandledexpression.com/general/rust/2018/02/02/poc-compiling-to-ebpf-from-rust.html) however I found the need to use gobpf\nunecessary.\n\n\u003e The blog uses gobpf simply from what I can surmise to leverage gobpf ability to load ebpf programs\n\u003e for kprobes. gobpf uses the section names in a well understood format to attach the filter to the\n\u003e correct function.\n\n## Building\n\nThe following will has `rustc` emit the LLVM IR instead of produce a full library.\nThe LLVM IR can then be fed into `llc` which can generate the correct eBPF object ELF file.\n\n```bash\ncargo rustc --release -- --emit=llvm-ir\ncp target/release/deps/rust_ebpf_demo-*.ll rust_ebpf_demo.ll\ncargo rustc --release -- --emit=llvm-bc\ncp target/release/deps/rust_ebpf_demo-*.bc rust_ebpf_demo.bc\nllc rust_ebpf_demo.bc -march=bpf -filetype=obj -o rust_ebpf_demo.o\n```\n\n## Testing\n\nIn order to see the test you have to make sure you have the trace pipe enabled.\n\n```bash\necho 1 \u003e /sys/kernel/debug/tracing/tracing_on\n\n# Once enabled you can do:\nsudo cat /sys/kernel/debug/tracing/trace_pipe \n```","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffzakaria%2Frust-ebpf-demo","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Ffzakaria%2Frust-ebpf-demo","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Ffzakaria%2Frust-ebpf-demo/lists"}