Far much easier to suppress kernel/driver log of kernel addresses and deny access to /dev/kmem, et. al.<p>Leaving eBPF access open demonstratively has made way for file-less persistent malware to linger on unwantedly.<p>A real cybersecurity specialist would only allow eBPF access on host OS if no network access can be made to the host OS (and its ok for guest VMs to have eBPF).<p>An Uber cybersecurity goon, however, would compile out the eBPF JIT access from the Linux kernel (or use BSD-variant, instead).