SunnyDayBPF: Post-Syscall User-Buffer Telemetry Deception with eBPF

SunnyDayBPF: Post-Syscall User-Buffer Telemetry Deception with eBPF Security tools do not observe reality directly. They observe telemetry. And telemetry is only as trustworthy as the path that produced it. SunnyDayBPF is a research technique that explores what happens when that path can be influenced after a read-like syscall has already completed. What is SunnyDayBPF? SunnyDayBPF is an eBPF-based post-syscall user-buffer telemetry deception research technique originally proposed and researched