Tool
eBPF is a Linux kernel technology for running sandboxed programs in the kernel without modifying kernel source code or loading a kernel module. In the cited context, it was considered as a kernel-level interception mechanism for a context-firewall prototype, but was not available on macOS.
1 use taken from transcripts — each links to the moment in the video.
Kernel-level interception technology considered for the context-firewall prototype (not available on Mac)
1 in the library.