BPF Tokens in Linux Distributions: A Path to Safe User-Space eBPF#

Daniel Mellado

• Why: eBPF's privileged-by-default model has blocked unprivileged-but-legitimate uses (observability agents, service meshes) in containers and distros for years; BPF tokens are the kernel's new delegation mechanism, and this is about how distributions adopt them.
• What: An explanation of BPF tokens as a kernel mechanism for delegating restricted eBPF privileges to unprivileged processes, plus how distros (Fedora is the example) can package token policies to give users tracing/observability/networking tools without root or CAP_SYS_ADMIN.
• How: (From the abstract: walkthrough of real token policies, the delegation model, and the implications for developer workflows, container runtimes, and system services in Fedora and other distros.)
• Where applicable: Distro and platform teams designing safe eBPF access for non-root users; relevant to anyone running eBPF-based networking in multi-tenant or least-privilege environments. (from abstract only — no slides available)