In this challenge, you’ll tackle the most fundamental eBPF tasks. We’ve taught you the basics — now it’s your turn to put them into practice.
Before you get going, build and run the eBPF application. You’ll find it in the ebpf-hello-world/challenge directory — and yes, we’ve slipped in a verifier error on purpose just to keep you on your toes. Your mission - figure out why it fails and fix it.
Hint 1 💡
It’s an easy one — try building and running the "broken" program and you’ll understand.
Now that your program is running, let’s inspect it.
Keep it running, then open a second Term 2 terminal on the right (click the + at the top).
Every eBPF program gets a unique ID for tracking. Can you find the ID of the program you just started?
Hint 1 💡
sudo bpftool --help is your friend 😉
Sometimes, knowing which user loaded an eBPF program is useful for accountability and security.
Find the User Identifier (UID) that loaded the eBPF program of type tracepoint with name challenge.
We also learned that not all eBPF programs support every eBPF helper function.
Can you find whether an eBPF program of type tracepoint support the bpf_override_return() helper? (Answer with yes or no)
Hint 1 💡
This one is up to you — either the eBPF documentation or sudo bpftool --help will point you in the right direction 😉
What about eBPF maps - can you find the ID of the exec_count eBPF map that was defined and loaded in your eBPF program?
Hint 1 💡
sudo bpftool --help is your friend 😉
And for the last, slightly harder question before I let you go...
Can you recall what eBPF map flag should one provide to the bpf_map_update_elem() that adds the entry only if the key doesn't exist yet.
Hint 1 💡
Feel free to check the eBPF docs — you don’t need to know everything by heart, just how to find it 😉
Level up your Server Side game — Join 15,000 engineers who receive insightful learning materials straight to their inbox