Caching policy lookups per inode cuts eBPF security agent CPU cost ~90%
JeremyCMorgan · x · 2026-09-25
Developer Nathan Naveen details an optimization to his open-source eBPF security agent (github.com/bomfather/agent).
Problem: using an LSM hook on file open, the agent reconstructs the path and walks up parent dentries to find which path-based policy applies. Deciding which policy applies — not enforcing it — dominated kernel CPU cost, especially with repeated access to the same subtrees (e.g. Postgres reading its data directory).
Fix: memoize the resulting policy per inode. Kernel CPU cost dropped about 90%.
Key lesson: the hard part is the cache key and invalidation under Linux filesystem semantics. The author notes the code is hand-written, not AI-generated.
More from coding & agent
- Practical guide to shipping MCPs users want: match your dashboard, skip CodeMode, add docs search — teropa · 2026-09-25
- SkillsBench accepted at NeurIPS 2026: 87-task benchmark tests whether agent skills actually help — HanchungLee · 2026-09-25
- Neo Roundtable: a tiny shared conversation layer so ChatGPT, Claude and coding agents stop re-explaining your project — gambit2054 · 2026-09-25
- Dev builds local AI GTM workflow, argues the next platform entry point is hardware-bound — dotey · 2026-09-25
- TypeSafe AI launches Jev, a 'System One' model for bounded decisions in agent runs — hardimanjames · 2026-09-25
- "Astra, get me 99 fishing": one-line prompt sends an AI agent grinding RuneScape — justalexoki · 2026-09-25