I Spy With My Kernel Eye (What your box is doing before you ever log in)

Name: I Spy With My Kernel Eye (What your box is doing before you ever log in)
Start: 2026-10-01T15:50:00-05:00
End: 2026-10-01T16:10:00-05:00
Location: The Rand

When: Thu, Oct 1 · 3:50 – 4:10 PM
Where: The Rand, 3rd Floor

Everything on your box passes through the kernel, but almost none of it is visible from up top. This talk walks the boot path down to the kernel, then uses eBPF to watch a real login happen live from the inside, including the processes ps never catches and the exact moment PAM decides whether to let you in. No patch, no module, no reboot.

Tech & Builders circuit, sponsored by

All of Linux San Antonio The rest of the day Everything at The Rand