Cilium - eBPF-based Networking, Security, and Observability

•    Go

---

Cilium is open source software for providing and transparently securing network connectivity and loadbalancing between application workloads such as application containers or processes. Cilium operates at Layer 3/4 to provide traditional networking and security services as well as Layer 7 to protect and secure use of modern application protocols such as HTTP, gRPC and Kafka. Cilium is integrated into common orchestration frameworks such as Kubernetes.

kubernetes security networking monitoring kernel containers k8s ebpf xdp troubleshooting observability cni loadbalancing bpf kubernetes-networking load-balancer

bcc - BCC - Tools for BPF-based Linux IO analysis, networking, monitoring, and more

•    Python

---

BCC is a toolkit for creating efficient kernel tracing and manipulation programs, and includes several useful tools and examples. It makes use of extended BPF (Berkeley Packet Filters), formally known as eBPF, a new feature that was first added to Linux 3.15. Much of what BCC uses requires Linux 4.1 and above. One of the more interesting features in this cycle is the ability to attach eBPF programs (user-defined, sandboxed bytecode executed by the kernel) to kprobes. This allows user-defined instrumentation on a live kernel image that can never crash, hang or interfere with the kernel negatively.

kmon - Linux Kernel Manager and Activity Monitor

•    Rust

---

kmon provides a text-based user interface for managing the Linux kernel modules and monitoring the kernel activities. By managing, it means loading, unloading, blacklisting and showing the information of a module. These updates in the kernel modules, logs about the hardware and other kernel messages can be tracked with the real-time activity monitor in kmon.

monitoring management linux-kernel tui kernel-modules hacktoberfest kernel-activities kernel-information

libfuse - The reference implementation of the Linux FUSE (Filesystem in Userspace) interface

•    C

---

FUSE (Filesystem in Userspace) is an interface for userspace programs to export a filesystem to the Linux kernel. The FUSE project consists of two components: the fuse kernel module (maintained in the regular kernel repositories) and the libfuse userspace library (maintained in this repository). libfuse provides the reference implementation for communicating with the FUSE kernel module. A FUSE file system is typically implemented as a standalone application that links with libfuse. libfuse provides functions to mount the file system, unmount it, read requests from the kernel, and send responses back. libfuse offers two APIs: a "high-level", synchronous API, and a "low-level" asynchronous API. In both cases, incoming requests from the kernel are passed to the main program using callbacks. When using the high-level API, the callbacks may work with file names and paths instead of inodes, and processing of a request finishes when the callback function returns. When using the low-level API, the callbacks must work with inodes and responses must be sent explicitly using a separate set of API functions.

filesystem file-system

f-stack - F-Stack is an user space network development kit with high performance based on DPDK, FreeBSD TCP/IP stack and coroutine API

•    C

---

With the rapid development of Network Interface Cards the poor performance of data packet processing with the Linux kernel has become the bottleneck in modern network systems. Yet, the increasing demands of the Internet's growth demand a higher performant network processing solution. Kernel bypass has emerged to catch more and more attention. There are various similar technologies such as: DPDK, NETMAP and PF_RING. The main idea of kernel bypass is that Linux is only used to deal with control flow; all data streams are processed in user space. Therefore, kernel bypass can avoid performance bottlenecks caused by kernel packet copying, thread scheduling, system calls, and interrupts. Furthermore, kernel bypass can achieve higher performance with multi-optimizing methods. Within various techniques, DPDK has been widely used because of it's more thorough isolation from kernel scheduling and active community support. To deal with the increasingly severe DDoS attacks the authorized DNS server of Tencent Cloud DNSPod switched from Gigabit Ethernet to 10-Gigabit at the end of 2012. We faced several options: one is to continue to use the original network stack in the Linux kernel, another is to use kernel bypass techniques. After several rounds of investigation; we finally chose to develop our next generation of DNS server based on DPDK. The reason is DPDK provides ultra-high performance and can be seamlessly extended to 40G, or even 100G NIC, in the future.

kernel-module-fun - Some fun things you can do with kernel modules (all "bad ideas")

•    C

---

I didn't know at all how kernel modules worked. This is me learning how. This is all tested using the 3.5.0-18 kernel. hello-packet.c: logs every time your computer receives a packet. This one could easily be modified to drop packets 50% of the time.

ExLight 32bit Linux Live DVD

•    

---

ExLight 13.04 32bit Linux Live DVD with Enlightenment 17

fibratus - Tool for exploration and tracing of the Windows kernel

•    Python

---

Fibratus is a tool which is able to capture the most of the Windows kernel activity - process/thread creation and termination, context switches, file system I/O, registry, network activity, DLL loading/unloading and much more. The kernel events can be easily streamed to a number of output sinks like AMQP message brokers, Elasticsearch clusters or standard output stream. You can use filaments (lightweight Python modules) to extend Fibratus with your own arsenal of tools and so leverage the power of the Python's ecosystem. Download the latest release (Windows installer). The changelog and older releases can be found here.

windows-kernel instrumentation cython etw

raspberry-pi-os - Learning operating system development using Linux kernel and Raspberry Pi

•    C

---

This repository contains a step-by-step guide that teaches how to create a simple operating system (OS) kernel from scratch. I call this OS Raspberry Pi OS or just RPi OS. The RPi OS source code is largely based on Linux kernel, but the OS has very limited functionality and supports only Raspberry PI 3. Each lesson is designed in such a way that it first explains how some kernel feature is implemented in the RPi OS, and then it tries to demonstrate how the same functionality works in the Linux kernel. Each lesson has a corresponding folder in the src directory, which contains a snapshot of the OS source code at the time when the lesson had just been completed. This allows the introduction of new concepts gracefully and helps readers to follow the evolution of the RPi OS. Understanding this guide doesn't require any specific OS development skills.

raspberry-pi linux-kernel osdev arm operating-system raspberry-pi-3 armv8 kernel tutorial assembler education resource raspberry-pi-os learn

Two Kernel Monte

•    C

---

Two Kernel Monte is a Linux kernel module which allows Linux to load another kernel image into RAM and restart the machine from that kernel. The loader supports initial RAM disks and passing arbitrary kernel command line parameters to the new kernel.

Sailfish OS - Mobile Operating System

•    C++

---

Sailfish OS is a mobile operating system built on top of Mer project and Qt5. The UI is built with QML and QtQuick2 and Wayland. It is compatible with Android.

mobile-os mobile-operating-system operating-system

apollo-kernel - Collections of Apollo Kernels

•    Shell

---

The Apollo Kernel provides the necessary kernel level support to run Apollo software stack. In the first release, we add the most popular solution, Linux Kernel, under the linux directory. Apollo Linux Kernel is based on official Linux Kernel 4.4.32 with some modifications.

cloud-kernel - Cloud Kernel - an open-source Linux kernel originated by Alibaba Operating System Team

•    C

---

Cloud Kernel - an open-source Linux kernel originated by Alibaba Operating System Team

kernel os ecs aliyun alibabacloud aliyunlinux alibabacloudlinux

kbuild - Linux Kernel Build (Archive)

•    C

---

This project has moved to: http://vger.kernel.org/vger-lists.html#linux-kbuild Here, you can find the old mailing list, files and website regarding: Linux kernel build. Patches, documentation, and auxilary programs related to the kernel configuration

The Plastic File System

•    C++

---

The Plastic File System is an LD_PRELOAD module for manipulating executing programs' ideas of what the file system looks like. This allows virtual file systems to exist in user space, without kernel hacks or kernel modules.

ansible-jupyter-kernel - Jupyter Notebook Kernel for running Ansible Tasks and Playbooks

•    Python

---

The Ansible Jupyter Kernel adds a kernel backend for Jupyter to interface directly with Ansible and construct plays and tasks and execute them on the fly. ansible-kernel is available to be installed from pypi but you can also install it locally. The setup package itself will register the kernel with Jupyter automatically.

bochspwn-reloaded - A Bochs-based instrumentation performing kernel memory taint tracking to detect disclosure of uninitialized memory to ring 3

•    C++

---

Bochspwn Reloaded is an instrumentation module for the Bochs IA-32 emulator, similar to the original Bochspwn project from 2013. It performs taint tracking of the kernel address space of the guest operating systems, to detect the disclosure of uninitialized kernel stack/heap memory to user-mode and other data sinks. It helped us identify over 70 bugs in the Windows kernel, and more than 10 lesser bugs in Linux in 2017 and early 2018. The tool was discussed at the REcon Montreal, Black Hat USA, and INFILTRATE conferences, as well as in the Detecting Kernel Memory Disclosure with x86 Emulation and Taint Tracking white paper. The paper includes a comprehensive description of the general kernel infoleak bug class, as well as an in-depth study of Bochspwn Reloaded and its inner workings. We highly recommend the read before diving right into the source code, as it may answer many potential questions that may arise while experimenting with the tool. Specifically, Chapter 3 covers the fundamental ideas behind it and the implementation details of the software.

Katran - A high performance layer 4 load balancer

•    C++

---

Katran is a C++ library and BPF program to build high-performance layer 4 load balancing forwarding plane. Katran leverages XDP infrastructure from the kernel to provide an in-kernel facility for fast packet's processing.

load-balancer layer4

BadMEM patches/utils for Linux Kernel

•    C

---

Production of a patch to make (partly) buggy memory modules work in a (vanilla)-Linux kernel; kernel patch and additional (user-space) utilities

Linux Kernel Module Programming Guide

•    

---

The Linux Kernel Module Programming Guide (LKMPG or just mpg) is a guide that teaches the basics of writing modules and device drivers for the Linux Kernel.