{
 "type": "excalidraw",
 "version": 2,
 "source": "https://excalidraw.com",
 "elements": [
  {
   "id": "r1801481181",
   "type": "rectangle",
   "x": 40,
   "y": 120,
   "width": 170,
   "height": 64,
   "angle": 0,
   "strokeColor": "#2f6db5",
   "backgroundColor": "#eef4fb",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 3
   },
   "seed": 1380124308,
   "versionNonce": 188818498,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false
  },
  {
   "id": "t1749516494",
   "type": "text",
   "x": 50,
   "y": 128,
   "width": 40,
   "height": 17.5,
   "angle": 0,
   "strokeColor": "#111111",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 1420605912,
   "versionNonce": 975693540,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "sudo",
   "fontSize": 14,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "sudo",
   "lineHeight": 1.25,
   "baseline": 14
  },
  {
   "id": "t164946047",
   "type": "text",
   "x": 50,
   "y": 148,
   "width": 108.9,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 22891079,
   "versionNonce": 1483154333,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "read(/etc/sudoers)",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "read(/etc/sudoers)",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "r790245477",
   "type": "rectangle",
   "x": 290,
   "y": 108,
   "width": 250,
   "height": 88,
   "angle": 0,
   "strokeColor": "#e8870c",
   "backgroundColor": "#fff8ef",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 3
   },
   "seed": 1311256581,
   "versionNonce": 627789841,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false
  },
  {
   "id": "t1368806643",
   "type": "text",
   "x": 300,
   "y": 116,
   "width": 146.3,
   "height": 17.5,
   "angle": 0,
   "strokeColor": "#111111",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 1901255302,
   "versionNonce": 439654833,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "eBPF read exit hook",
   "fontSize": 14,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "eBPF read exit hook",
   "lineHeight": 1.25,
   "baseline": 14
  },
  {
   "id": "t1607654274",
   "type": "text",
   "x": 300,
   "y": 136,
   "width": 90.75000000000001,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 623260348,
   "versionNonce": 1677022140,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "comm == \"sudo\"?",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "comm == \"sudo\"?",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "t804720558",
   "type": "text",
   "x": 300,
   "y": 151,
   "width": 121.00000000000001,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 881448970,
   "versionNonce": 543698248,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "overwrite the buffer",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "overwrite the buffer",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "r661695145",
   "type": "rectangle",
   "x": 620,
   "y": 120,
   "width": 220,
   "height": 64,
   "angle": 0,
   "strokeColor": "#111111",
   "backgroundColor": "#111111",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 3
   },
   "seed": 881837674,
   "versionNonce": 99999240,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false
  },
  {
   "id": "t35854447",
   "type": "text",
   "x": 630,
   "y": 128,
   "width": 177.10000000000002,
   "height": 17.5,
   "angle": 0,
   "strokeColor": "#ffffff",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 403997024,
   "versionNonce": 1766729135,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "sudo sees injected line",
   "fontSize": 14,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "sudo sees injected line",
   "lineHeight": 1.25,
   "baseline": 14
  },
  {
   "id": "t1491621779",
   "type": "text",
   "x": 630,
   "y": 148,
   "width": 66.55000000000001,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 946146792,
   "versionNonce": 921949098,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "grants root",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "grants root",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "a1163057734",
   "type": "arrow",
   "x": 210,
   "y": 152,
   "width": 80,
   "height": 0,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 2
   },
   "seed": 999023788,
   "versionNonce": 953631571,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "points": [
    [
     0,
     0
    ],
    [
     80,
     0
    ]
   ],
   "lastCommittedPoint": null,
   "startBinding": null,
   "endBinding": null,
   "startArrowhead": null,
   "endArrowhead": "arrow"
  },
  {
   "id": "t417011944",
   "type": "text",
   "x": 250.0,
   "y": 138.0,
   "width": 84.7,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#555555",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 14549976,
   "versionNonce": 960068421,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "returned bytes",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "returned bytes",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "a924052036",
   "type": "arrow",
   "x": 540,
   "y": 152,
   "width": 80,
   "height": 0,
   "angle": 0,
   "strokeColor": "#b8650a",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 2,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": {
    "type": 2
   },
   "seed": 190819721,
   "versionNonce": 672019922,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "points": [
    [
     0,
     0
    ],
    [
     80,
     0
    ]
   ],
   "lastCommittedPoint": null,
   "startBinding": null,
   "endBinding": null,
   "startArrowhead": null,
   "endArrowhead": "arrow"
  },
  {
   "id": "t580923827",
   "type": "text",
   "x": 580.0,
   "y": 138.0,
   "width": 40,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#b8650a",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 1387245220,
   "versionNonce": 789645194,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "forged",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "forged",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "t607613337",
   "type": "text",
   "x": 440,
   "y": 24,
   "width": 441.65000000000003,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#b8650a",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 47738687,
   "versionNonce": 1647147612,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "the file on disk is never touched \u2014 only the bytes sudo reads into memory",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "the file on disk is never touched \u2014 only the bytes sudo reads into memory",
   "lineHeight": 1.25,
   "baseline": 11
  },
  {
   "id": "t375800974",
   "type": "text",
   "x": 440,
   "y": 276,
   "width": 520.3000000000001,
   "height": 13.75,
   "angle": 0,
   "strokeColor": "#888888",
   "backgroundColor": "transparent",
   "fillStyle": "solid",
   "strokeWidth": 1,
   "strokeStyle": "solid",
   "roughness": 1,
   "opacity": 100,
   "groupIds": [],
   "frameId": null,
   "roundness": null,
   "seed": 1000770471,
   "versionNonce": 500435775,
   "isDeleted": false,
   "boundElements": [],
   "updated": 1,
   "link": null,
   "locked": false,
   "text": "DEFENSE: same tells as Ch 39 (taint, loaded progs); LSM can block bpf_probe_write_user",
   "fontSize": 11,
   "fontFamily": 1,
   "textAlign": "left",
   "verticalAlign": "top",
   "containerId": null,
   "originalText": "DEFENSE: same tells as Ch 39 (taint, loaded progs); LSM can block bpf_probe_write_user",
   "lineHeight": 1.25,
   "baseline": 11
  }
 ],
 "appState": {
  "viewBackgroundColor": "#ffffff",
  "gridSize": null
 },
 "files": {}
}