Note that despite the headline, the feature actually used here is kprobe and uprobe (which use eBPF to collect data using eBPF every time an event, such as passing a certain point in code, is executed - allowing for hooking of functions and extraction of data). You can turn them off with CONFIG_KPROBE_EVENTS=n and CONFIG_UPROBE_EVENTS=n.
That said, there are other ways to do similar probing:
- Loading kernel modules.
- Using ptrace.
- Using LD_PRELOAD against a dynamic binary.
Right; disabling eBPF doesn't solve this. And the bigger point is that this kind of eBPF is still super-user only.
Apart from the more exotic facilities, the critical facilities that would be hard to disable include LD_PRELOAD for interposers/shims (as you mentioned), and gdb for just setting breakpoints on crypto functions. And if neither of those existed, then I may have to edit openssl code and recompile my own edited version. And if that wasn't allowed (signed libraries) then maybe I'd edit the application code or binaries.
That said, there are other ways to do similar probing: - Loading kernel modules. - Using ptrace. - Using LD_PRELOAD against a dynamic binary.