Merge pull request #172 from ErenAri/feat/aegis-next-p3

feat: denyComm, EnforceCapable probing, rate-limit enforcement

Author: ErenAri

README.md

@@ -125,6 +125,45 @@ The operator includes a built-in web console for monitoring policy status, daemo
 - Zero JavaScript framework dependencies
 - Embedded in the operator binary via `go:embed`
 
+## aegis-next Prototype
+
+The `prototype/aegis-next/` directory contains a research prototype that
+explores **post-2024 BPF primitives** — features no shipping security agent
+uses as load-bearing infrastructure today. It is an isolated playground:
+not linked into the mainline daemon, not shipped in release packages, and
+gated behind `cmake -DBUILD_AEGIS_NEXT=ON`.
+
+**Core idea:** an 82 MiB BPF arena map (`BPF_MAP_TYPE_ARENA`, kernel 6.9+)
+replaces per-event perfbuf/ringbuf round-trips. Nine LSM hooks write 80-byte
+provenance nodes directly into the arena. Userspace `mmap(2)`s the arena
+read-only and walks the slot array on demand — zero `bpf_map_lookup_elem`
+syscalls for graph traversal.
+
+Key capabilities (all fully implemented):
+
+| Phase | Highlights |
+|-------|------------|
+| **P1 — Arena Infrastructure** | O(1) hash table (64K buckets, 8-step probe), path slab (4K x 256B), network 5-tuple slab (4K x 48B), namespace awareness, ringbuf hybrid alerts |
+| **P2 — Enforcement** | Policy-driven deny/quarantine/kill, 9 LSM hooks, in-kernel quarantine bridge to sched_ext, tiered CPU scheduling (throttle/pin/starve), BPF self-protection |
+| **P3 — Production Readiness** | Ringbuf-only fallback (kernel < 6.9), 39 GTest cases, JSONL export with rotation, runtime feature probing, arena pre-fault |
+| **P4 — Beyond State of the Art** | In-kernel binary authorization (fsverity), user_ringbuf zero-copy policy reload, per-cgroup rate limiting with auto-quarantine, file security labeling (`bpf_set_dentry_xattr`), targeted signal delivery (`bpf_send_signal_task`) |
+
+**No other open-source agent** combines arena-backed provenance graphs,
+sched_ext quarantine, and in-kernel binary authorization in a single BPF
+program.
+
+Build and run:
+```bash
+cmake -DBUILD_AEGIS_NEXT=ON -S . -B build && cmake --build build --target aegisbpf-next
+sudo ./build/prototype/aegisbpf-next attach    # arena + 9 LSM hooks
+sudo ./build/prototype/aegisbpf-next status    # feature probes + utilization
+sudo ./build/prototype/aegisbpf-next policy load examples/policy.rules
+```
+
+Full documentation: [`prototype/aegis-next/README.md`](prototype/aegis-next/README.md) |
+Roadmap status: [`prototype/aegis-next/ROADMAP.md`](prototype/aegis-next/ROADMAP.md) |
+Architecture: [`prototype/aegis-next/ARCHITECTURE.md`](prototype/aegis-next/ARCHITECTURE.md)
+
 ## Comparison with Other Tools
 
 ### Architecture & feature matrix

bpf/aegis_common.h

@@ -465,6 +465,20 @@ struct {
     __type(value, __u8);
 } deny_path_map SEC(".maps");
 
+/* Deny-by-comm map: blocks execution of binaries whose basename
+ * matches a configured command name.  Key is the 16-byte comm
+ * string (TASK_COMM_LEN), value is unused. */
+#define MAX_DENY_COMM_ENTRIES 1024
+struct deny_comm_key {
+    char comm[16]; /* TASK_COMM_LEN */
+};
+struct {
+    __uint(type, BPF_MAP_TYPE_HASH);
+    __uint(max_entries, MAX_DENY_COMM_ENTRIES);
+    __type(key, struct deny_comm_key);
+    __type(value, __u8);
+} deny_comm_map SEC(".maps");
+
 struct {
     __uint(type, BPF_MAP_TYPE_PERCPU_HASH);
     __uint(max_entries, MAX_DENY_CGROUP_STATS_ENTRIES);

bpf/aegis_exec.bpf.h

@@ -182,6 +182,61 @@ int BPF_PROG(handle_bprm_check_security, struct linux_binprm *bprm)
         return 0;
     }
 
+    /* deny_comm check: extract basename from bprm->filename and look up
+     * in the deny_comm_map. This runs unconditionally — independent of
+     * exec identity mode — so that comm-based deny works as a standalone
+     * feature (e.g. blocking known crypto-miners by name). */
+    {
+        const char *fn_ptr = BPF_CORE_READ(bprm, filename);
+        if (fn_ptr) {
+            char fn[64] = {};
+            long fn_len = bpf_probe_read_kernel_str(fn, sizeof(fn), fn_ptr);
+            if (fn_len > 0) {
+                int base_off = 0;
+#pragma unroll
+                for (int i = 0; i < (int)sizeof(fn); ++i) {
+                    if (fn[i] == '\0')
+                        break;
+                    if (fn[i] == '/')
+                        base_off = i + 1;
+                }
+                struct deny_comm_key ck = {};
+                /* Copy basename into key. Buffer is zero-initialized and
+                 * null-terminated, so a fixed 15-byte copy captures the
+                 * comm name (TASK_COMM_LEN - 1). Clamp base_off so we
+                 * never read past the 64-byte fn buffer. */
+                if (base_off > 49)
+                    base_off = 49;
+                __builtin_memcpy(ck.comm, &fn[base_off], 15);
+                if (bpf_map_lookup_elem(&deny_comm_map, &ck)) {
+                    __u32 _pid = bpf_get_current_pid_tgid() >> 32;
+                    struct task_struct *_task = bpf_get_current_task_btf();
+                    __u8 _audit = get_effective_audit_mode();
+
+                    increment_block_stats();
+
+                    struct event *e = bpf_ringbuf_reserve(&events, sizeof(*e), 0);
+                    if (e) {
+                        e->type = EVENT_BLOCK;
+                        fill_block_event_process_info(&e->block, _pid, _task);
+                        e->block.cgid = bpf_get_current_cgroup_id();
+                        __builtin_memcpy(e->block.comm, ck.comm, 16);
+                        e->block.ino = 0;
+                        e->block.dev = 0;
+                        __builtin_memset(e->block.path, 0, sizeof(e->block.path));
+                        set_action_string(e->block.action, _audit, 0);
+                        bpf_ringbuf_submit(e, 0);
+                    }
+
+                    if (!_audit) {
+                        record_hook_latency(HOOK_BPRM_CHECK, _start_ns);
+                        return -EPERM;
+                    }
+                }
+            }
+        }
+    }
+
     if (!exec_identity_mode_enabled()) {
         record_hook_latency(HOOK_BPRM_CHECK, _start_ns);
         return 0;

docs/BPF_MAP_SCHEMA.md

@@ -186,6 +186,29 @@ struct path_key {
 };
 ```
 
+### `deny_comm_map`
+
+| Property       | Value |
+|----------------|-------|
+| Type           | `BPF_MAP_TYPE_HASH` |
+| Key            | `struct deny_comm_key` (16 bytes) |
+| Value          | `__u8` (presence flag) |
+| Max entries    | 1,024 |
+| Pin path       | `/sys/fs/bpf/aegisbpf/deny_comm` |
+| Access         | BPF: read; Userspace: read/write |
+| Lifecycle      | Managed by policy apply (shadow map swap) |
+
+Process comm-name deny list. Checked in `bprm_check_security` by extracting
+the basename from `bprm->filename` and looking it up in this map. Entries are
+null-padded to `TASK_COMM_LEN` (16 bytes). Maximum comm length is 15 characters.
+
+**Key struct:**
+```c
+struct deny_comm_key {
+    char comm[16];  /* TASK_COMM_LEN */
+};
+```
+
 ---
 
 ## Network Deny Rules
@@ -926,6 +949,7 @@ struct forensic_event {
 | `survival_allowlist` | 16 + 1 = 17 B | 256 | ~4 KB |
 | `deny_inode_map` | 16 + 1 = 17 B | 65,536 | ~1.1 MB |
 | `deny_path_map` | 256 + 1 = 257 B | 16,384 | ~4.2 MB |
+| `deny_comm_map` | 16 + 1 = 17 B | 1,024 | ~17 KB |
 | `deny_ipv4` | 4 + 1 = 5 B | 65,536 | ~327 KB |
 | `deny_ipv6` | 16 + 1 = 17 B | 65,536 | ~1.1 MB |
 | `deny_port` | 4 + 1 = 5 B | 4,096 | ~20 KB |

helm/aegisbpf/templates/operator-deployment.yaml

@@ -27,6 +27,10 @@ spec:
         runAsNonRoot: true
         seccompProfile:
           type: RuntimeDefault
+      {{- with .Values.operator.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: operator
           image: "{{ .Values.operator.image.repository }}:{{ .Values.operator.image.tag }}"

helm/aegisbpf/values.yaml

@@ -261,6 +261,14 @@ operator:
     pullPolicy: IfNotPresent
 
   replicas: 1
+  # Pod topology spread for HA (effective when replicas > 1).
+  topologySpreadConstraints:
+    - maxSkew: 1
+      topologyKey: kubernetes.io/hostname
+      whenUnsatisfiable: ScheduleAnyway
+      labelSelector:
+        matchLabels:
+          app.kubernetes.io/component: operator
 
   leaderElect: true
   enableIdentityResolution: true

operator/cmd/operator/main.go

@@ -91,8 +91,9 @@ func main() {
 	eventBroker := console.NewBroker()
 
 	if err := (&controllers.AegisPolicyReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
+		Client:    mgr.GetClient(),
+		Scheme:    mgr.GetScheme(),
+		Publisher: eventBroker,
 	}).SetupWithManager(mgr); err != nil {
 		logger.Error(err, "Unable to create AegisPolicy controller")
 		os.Exit(1)
@@ -109,16 +110,18 @@ func main() {
 	}
 
 	if err := (&controllers.AegisClusterPolicyReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
+		Client:    mgr.GetClient(),
+		Scheme:    mgr.GetScheme(),
+		Publisher: eventBroker,
 	}).SetupWithManager(mgr); err != nil {
 		logger.Error(err, "Unable to create AegisClusterPolicy controller")
 		os.Exit(1)
 	}
 
 	if err := (&controllers.MergedPolicyReconciler{
-		Client: mgr.GetClient(),
-		Scheme: mgr.GetScheme(),
+		Client:    mgr.GetClient(),
+		Scheme:    mgr.GetScheme(),
+		Publisher: eventBroker,
 	}).SetupWithManager(mgr); err != nil {
 		logger.Error(err, "Unable to create MergedPolicy controller")
 		os.Exit(1)

operator/config/rbac/role.yaml

@@ -21,6 +21,10 @@ rules:
   - apiGroups: [""]
     resources: ["namespaces"]
     verbs: ["get", "list", "create"]
+  # Nodes for EnforceCapable probing
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list", "watch"]
   # Pods for identity resolution
   - apiGroups: [""]
     resources: ["pods"]

operator/controllers/aegisclusterpolicy_controller.go

@@ -30,7 +30,8 @@ const (
 // AegisClusterPolicyReconciler reconciles AegisClusterPolicy objects.
 type AegisClusterPolicyReconciler struct {
 	client.Client
-	Scheme *runtime.Scheme
+	Scheme    *runtime.Scheme
+	Publisher EventPublisher // optional: pushes SSE events to console
 }
 
 // +kubebuilder:rbac:groups=aegisbpf.io,resources=aegisclusterpolicies,verbs=get;list;watch;update;patch
@@ -71,7 +72,7 @@ func (r *AegisClusterPolicyReconciler) Reconcile(ctx context.Context, req ctrl.R
 		}
 	}
 
-	// Translate CRD → INI.
+	// Translate CRD → INI (mainline daemon).
 	result, err := policy.TranslateToINI(acp.Spec)
 	if err != nil {
 		logger.Error(err, "Failed to translate cluster policy")
@@ -80,8 +81,19 @@ func (r *AegisClusterPolicyReconciler) Reconcile(ctx context.Context, req ctrl.R
 			fmt.Sprintf("Translation failed: %v", err))
 		return r.updateStatus(ctx, &acp, "Error", fmt.Sprintf("Translation failed: %v", err), "")
 	}
+
+	// Translate CRD → aegis-next line-based policy.
+	nextResult, err := policy.TranslateToAegisNext(acp.Spec)
+	if err != nil {
+		logger.Error(err, "Failed to translate aegis-next cluster policy")
+		markPolicyInvalid(&acp.Status, acp.Generation,
+			v1alpha1.ReasonTranslationFailed,
+			fmt.Sprintf("aegis-next translation failed: %v", err))
+		return r.updateStatus(ctx, &acp, "Error", fmt.Sprintf("aegis-next translation failed: %v", err), "")
+	}
+
 	markPolicyValid(&acp.Status, acp.Generation)
-	markEnforceCapableUnknown(&acp.Status, acp.Generation)
+	probeEnforceCapable(ctx, r.Client, &acp.Status, acp.Generation)
 	if acp.Spec.Selector != nil {
 		markLegacySelectorDeprecated(&acp.Status, acp.Generation)
 	} else {
@@ -91,6 +103,7 @@ func (r *AegisClusterPolicyReconciler) Reconcile(ctx context.Context, req ctrl.R
 	logger.Info("Translated cluster policy",
 		"name", acp.Name,
 		"hash", result.SHA256[:12],
+		"nextHash", nextResult.SHA256[:12],
 		"mode", acp.Spec.Mode,
 	)
 
@@ -111,9 +124,11 @@ func (r *AegisClusterPolicyReconciler) Reconcile(ctx context.Context, req ctrl.R
 			},
 		},
 		Data: map[string]string{
-			PolicyDataKey: result.INI,
-			PolicyHashKey: result.SHA256,
-			PolicyModeKey: acp.Spec.Mode,
+			PolicyDataKey:     result.INI,
+			PolicyHashKey:     result.SHA256,
+			PolicyModeKey:     acp.Spec.Mode,
+			NextPolicyDataKey: nextResult.INI,
+			NextPolicyHashKey: nextResult.SHA256,
 		},
 	}
 
@@ -132,7 +147,7 @@ func (r *AegisClusterPolicyReconciler) Reconcile(ctx context.Context, req ctrl.R
 	} else if err != nil {
 		return ctrl.Result{}, err
 	} else {
-		if existing.Data[PolicyHashKey] != result.SHA256 {
+		if existing.Data[PolicyHashKey] != result.SHA256 || existing.Data[NextPolicyHashKey] != nextResult.SHA256 {
 			existing.Data = cm.Data
 			existing.Labels = cm.Labels
 			existing.Annotations = cm.Annotations
@@ -146,6 +161,9 @@ func (r *AegisClusterPolicyReconciler) Reconcile(ctx context.Context, req ctrl.R
 	}
 
 	markReady(&acp.Status, acp.Generation, "Cluster policy translated and ConfigMap written")
+	if r.Publisher != nil {
+		r.Publisher.PublishReconcile("AegisClusterPolicy", acp.Name, "Applied", "Cluster policy applied successfully")
+	}
 	return r.updateStatus(ctx, &acp, "Applied", "Cluster policy applied successfully", result.SHA256)
 }
 

operator/controllers/aegispolicy_controller.go

@@ -49,7 +49,8 @@ const (
 // AegisPolicyReconciler reconciles AegisPolicy objects.
 type AegisPolicyReconciler struct {
 	client.Client
-	Scheme *runtime.Scheme
+	Scheme    *runtime.Scheme
+	Publisher EventPublisher // optional: pushes SSE events to console
 }
 
 // +kubebuilder:rbac:groups=aegisbpf.io,resources=aegispolicies,verbs=get;list;watch;update;patch
@@ -119,7 +120,7 @@ func (r *AegisPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 	}
 
 	markPolicyValid(&ap.Status, ap.Generation)
-	markEnforceCapableUnknown(&ap.Status, ap.Generation)
+	probeEnforceCapable(ctx, r.Client, &ap.Status, ap.Generation)
 	if ap.Spec.Selector != nil {
 		markLegacySelectorDeprecated(&ap.Status, ap.Generation)
 	} else {
@@ -200,6 +201,9 @@ func (r *AegisPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Request)
 	policyReconcileTotal.WithLabelValues("success").Inc()
 	activePolicies.Inc()
 	markReady(&ap.Status, ap.Generation, "Policy translated and ConfigMap written")
+	if r.Publisher != nil {
+		r.Publisher.PublishReconcile("AegisPolicy", ap.Namespace+"/"+ap.Name, "Applied", "Policy applied successfully")
+	}
 	return r.updateStatus(ctx, &ap, "Applied", "Policy applied successfully", result.SHA256)
 }