MONITORING BASH `READLINE` WITH EBPF CO-RE & LLM ASSISTANCE

Summary from the TLDR InfoSec newsletter

Although the eBPF Compiler Collection (BCC) can monitor bash commands, it compiles programs dynamically, so the complete Clang/LLVM toolchain must be shipped to every machine. eBPF CO-RE (Compile Once - Run Everywhere) can enable portability across different kernel versions without recompilation. This article walks through how to write an eBPF program to monitor the `readline` program to monitor bash commands.