{
  lib,
  kernel,
  stdenv,
  clang-tools,
  llvmPackages,
  elfutils,
  flex,
  bison,
  bc,
  opensnitch,
  nixosTests,
  fetchpatch2,
}:

stdenv.mkDerivation rec {
  pname = "opensnitch_ebpf";
  version = "${opensnitch.version}-${kernel.version}";

  inherit (opensnitch) src;

  patches = [
    (fetchpatch2 {
      # fixes build failures on kernel >= 6.19 (#490127)
      # remove when added to a release
      name = "fix-kernel-6.19-build.patch";
      stripLen = 1;
      url = "https://github.com/evilsocket/opensnitch/commit/614537c92ec82f54f76a45fb406ad2fb6e6fa618.patch?full_index=1";
      hash = "sha256-FCJfDhgmnm1GXPDaxr+YpVWTRrwBvjVzvGdZSFB6SqQ=";
    })
  ];

  sourceRoot = "${src.name}/ebpf_prog";

  nativeBuildInputs = with llvmPackages; [
    bc
    bison
    clang
    clang-tools
    elfutils
    flex
    libllvm
  ];

  env.NIX_CFLAGS_COMPILE =
    # We set -fno-stack-protector here to work around a clang regression.
    # This is fine - bpf programs do not use stack protectors
    # https://aur.archlinux.org/cgit/aur.git/tree/PKGBUILD?h=opensnitch-ebpf-module&id=984b952a784eb701f691dd9f2d45dfeb8d15053b
    "-fno-stack-protector"
    # clang doesn't set this, so we have to
    # only relevant after 7.2 due to changes in https://github.com/torvalds/linux/commit/aef4dfa790b22d8052cfb78044eadbe03c876c39
    + lib.optionalString (lib.versionAtLeast kernel.version "7.2") " -DCC_USING_FENTRY";

  env.KERNEL_VER = kernel.modDirVersion;
  env.KERNEL_DIR = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/source";
  env.KERNEL_HEADERS = "${kernel.dev}/lib/modules/${kernel.modDirVersion}/build";

  extraConfig = ''
    CONFIG_UPROBE_EVENTS=y
  '';

  installPhase = ''
    runHook preInstall

    for file in opensnitch*.o; do
      install -Dm644 "$file" "$out/etc/opensnitchd/$file"
    done

    runHook postInstall
  '';

  postFixup = ''
    # reduces closure size significantly (fixes https://github.com/NixOS/nixpkgs/issues/391351)
    for file in $out/etc/opensnitchd/*.o; do
      llvm-strip --strip-debug $file
    done
  '';

  passthru.tests = {
    inherit (nixosTests) opensnitch;
  };

  meta = {
    description = "eBPF process monitor module for OpenSnitch";
    homepage = "https://github.com/evilsocket/opensnitch";
    license = lib.licenses.gpl3Only;
    maintainers = with lib.maintainers; [
      onny
      grimmauld
    ];
    platforms = lib.platforms.linux;
  };
}