Build a network packet filter that inspects or drops traffic at the kernel level without writing any C code.
Monitor system calls and kernel events in real time using eBPF probes written entirely in Rust.
Create a security enforcement tool that restricts process behavior using eBPF hooks compiled once and deployed across many kernel versions.
Attach an async event handler to kernel activity using Rust's tokio runtime for high-throughput eBPF programs.
| aya-rs/aya | zesterer/chumsky | ralfbiedert/cheats.rs | |
|---|---|---|---|
| Stars | 4,542 | 4,540 | 4,529 |
| Language | Rust | Rust | Rust |
| Setup difficulty | hard | moderate | easy |
| Complexity | 4/5 | 3/5 | 1/5 |
| Audience | developer | developer | developer |
Figures from each repo's GitHub metadata at analysis time.
Requires a Linux environment with eBPF support, no C compiler needed, but familiarity with Linux kernel concepts is assumed.
Aya is a Rust library for writing programs that run inside the Linux kernel using a technology called eBPF. eBPF lets you attach small programs to points in the kernel to observe system activity, filter network packets, or enforce security policies, all without modifying the kernel itself or rebooting. The library is aimed at Rust developers who want to build these kinds of tools without dealing with the C-based toolchains that most eBPF workflows normally require. Unlike similar tools, Aya does not depend on existing C libraries such as libbpf or bcc. It is written entirely in Rust, using only the operating system's own interface layer to communicate with the kernel. One practical benefit is that a program compiled with Aya and linked against musl (a small C standard library alternative) can be built once and then deployed on many different Linux kernel versions without recompiling, a feature the project calls compile once, run everywhere. The library supports several notable capabilities. BPF Type Format (BTF) lets programs compiled against one kernel version run on a different kernel version transparently. There is support for function calls and global variables inside eBPF programs. Aya also integrates with Rust's async runtimes, specifically tokio and async-std, for programs that need to handle events asynchronously. Build times are kept short because there is no requirement for kernel headers or a C compiler. A short code example in the README shows how to load a compiled eBPF object file, retrieve a specific program from it, load that program into the kernel, and attach it to a network control group to inspect incoming packets. This pattern covers the typical workflow for most eBPF-based tools built with the library. Aya is licensed under either the MIT license or the Apache License 2.0, and contributors can choose either when submitting code. A Discord community and a curated list of projects built with the library are both linked from the repository.
A Rust library for writing Linux kernel programs using eBPF, letting you observe system activity, filter network packets, or enforce security policies without modifying the kernel or rebooting, with no C compiler required.
Mainly Rust. The stack also includes Rust, eBPF, tokio.
Dual-licensed MIT or Apache 2.0, choose either, both allow commercial use and redistribution with minimal restrictions.
Setup difficulty is rated hard, with roughly 1h+ to a first successful run.
Mainly developer.
This repo across BitVibe Labs
Verify against the repo before relying on details.