Comment by lelanthran

I think you only need to use the eBPF approach for statically linked programs.

ISTR, at some point in the far past, using LD_PRELOAD with my own shims to capture TLS traffic before encryption/after decryption. I might have it lying around somewhere here.