My brother and I spent a lot of time designing our eBPF security agent to be really fast from the ground up, but recently we discovered we could make it much faster using memoization! A couple of weeks ago, I profiled the eBPF code and found that the most expensive part of the protection isn't actually enforcing a policy, but figuring out which policy applies to a given file open.

Our policies are path based, so our eBPF leverages an LSM hook that triggers on file open. We then reconstruct the path, walk up parent dentries, and check whether the file or any ancestor directory has a matching policy. While this works, it isn't performant, and we end up repeating much of the work for files we have already seen.

Our solution was to cache which policy applies for each inode using a three-field key: mount namespace ID, mount ID, and inode number. The cache value stores an access_index and cache state. This caching approach dropped our kernel CPU cost by about 90%. We use an LRU hash map with 10000 max entries for efficient lookups.

The cache prevents redundant path walks for repeated file accesses, especially beneficial for database workloads like Postgres that frequently reaccess the same file paths. Our open source implementation is available at https://github.com/bomfather/agent.