An eBPF kernel guard for vTPM access
Get picks like this daily. The day's top launches, AI/tech news, and a weekly opportunity spotlight — straight to your inbox.
This is 1 of 37 launches in security screening and access governance software — see how it stacks up on momentum and crowding →
51 other launches read as similar to this one →
Details
- External ID
- 49958131
- Source
- HN
- Company
- —
- Product
- An eBPF kernel guard for vTPM access
- Website domain
- github.com
- Launched
- Oct. 4, 2026
- Cohort
- —
- Upvotes
- 5
- Upvotes percentile
- 0.10
- Tags
- —
Description
A kernel guard I prototyped after eBPF and vTPM work for a customer, where we use the TPM to protect the private keys for mTLS. Any process running as root can open the TPM devices, and so can any process in the `tss` group, through `/dev/tpmrm0`. That means they can use those keys too. This is a prototype and some research into protecting this path.
Enrichment
- Niche
- security screening and access governance software
- Vertical
- Security
- Function
- Dev tools
- Audience
- Developer
- AI stance
- Not AI
- Project type
- Hobby / open-source project
- Normalized one-liner
- ebpf kernel monitor for vtpm access
- Manually corrected
- False
Could you build this?
No Developing an eBPF LSM or tracepoint guard for virtual TPM hardware interfaces requires deep Linux kernel internals, C/eBPF programming, and cryptographic hardware security knowledge.
What it would actually take: Requires writing eBPF LSM (Linux Security Module) hooks in C to inspect and restrict `open` and `ioctl` syscalls on `/dev/tpmrm0`, managing pinned BPF maps, and handling user-space policy daemons using `libbpf` with extensive testing against Linux kernel security mechanisms.
Discussion
No comments on this launch.
Competitors
Other products that read as similar to this one — 51 launches clear the similarity bar, closest 8 shown.
Attention rank: #50 of 52 (itself plus its competitors, highest first — normalized so YC and Product Hunt are compared fairly).
Launched 327 days after the earliest competitor.
- Cerberus · hn · 2025-12-20 · 12 upvotes · similarity 0.45
- Bomfather, eBPF Runtime Security · hn · 2026-10-13 · 5 upvotes · similarity 0.42
- DOOM in the kernel, or fibers in eBPF · hn · 2026-09-09 · 53 upvotes · similarity 0.42
- MTLS with keys never leaving the TPM · hn · 2026-07-26 · 5 upvotes · similarity 0.40
- Gecit · hn · 2026-04-05 · 9 upvotes · similarity 0.39
- KV-psi, using Linux PSI to to trim an LLM KV cache · hn · 2026-06-27 · 8 upvotes · similarity 0.39
- CargoWall · hn · 2026-03-31 · 14 upvotes · similarity 0.39
- Netfence · hn · 2026-01-25 · 58 upvotes · similarity 0.38
Other launches for this product
- No other launches for this product.