Hardening + honesty pass: logger/FORTIFY/fuzzing, LSM-hook BTF detection fix, opt-in signal-fallback

[ErenAri]

Summary

Hardening + honesty pass (Phase 0/1) plus a genuine enforcement bug fix and an
opt-in Tier-3 enforcement path. Five focused commits; verified on Linux 6.17
(BPF-LSM enabled). Full suite 292/293 — the one "failure" is the deliberate
90-day vendored-crypto review staleness gate (vendored_dependency_contract),
which is a governance control firing as designed, not a code defect.

Commits

1. fix(logging,policy): const char log field + correct policy-gen guard; align claims*

   • Adds a field(const std::string&, const char*) overload. Without it,
     C-string field values bound to the bool overload and rendered as true
     (e.g. {program=true}) in text logs/SIEM. Adds tests/test_logging.cpp.
   • Moves the first bump_policy_generation() into the direct-apply branch (it
     was the only atomic guard for that path, not dead code) and removes an
     unnecessary audit-downgrade window during shadow population.
   • README/GUARANTEES: module-load blocking requires active kernel lockdown;
     OverlayFS copy-up is detection + async re-propagation (ENFORCED→AUDITED).
     Adds docs/MEMORY_SAFETY.md.

2. build: strengthen userspace hardening — _FORTIFY_SOURCE=3,
   -fstack-clash-protection, -D_GLIBCXX_ASSERTIONS, each probed via
   check_<lang>_compiler_flag so the GCC/Clang × x86_64/arm64 matrix degrades
   gracefully. readelf confirms PIE, full RELRO, canary, FORTIFY _chk symbols.

3. ci(fuzz): ClusterFuzzLite integration — free, in-repo continuous fuzzing of
   the userspace input-parsing surface using the existing libFuzzer harnesses.
   The ENABLE_FUZZING block now honors $LIB_FUZZING_ENGINE (OSS-Fuzz/CFLite)
   and falls back to local -fsanitize=fuzzer,address; the five harness defs are
   deduped into a loop. All 5 fuzzers build locally; fuzz_policy runs clean.

4. fix(bpf): detect optional LSM hooks by their bpf_lsm_-prefixed BTF symbol
   ⚠️ Real enforcement bug. detect_missing_optional_lsm_hooks() queried the
   bare hook name (socket_connect) as a BTF FUNC. LSM attach points are
   bpf_lsm_socket_connect — the bare name never exists — so every optional LSM
   hook (network, bprm, mmap) was marked "missing" and disabled, silently
   downgrading network/exec/mmap enforcement; a fail-closed network policy made
   the daemon exit at the enforce gate. (File deny survived — those hooks are
   required, not optional.) Before: run --enforce with a network deny policy
   logged Disabling optional LSM program ... socket_connect and fail-closed.
   After: socket_connect attaches, daemon stays in ENFORCE, a connect() to a
   denied IP returns -EPERM (net_connect_block action=BLOCK), allowed IPs
   unaffected. This bug was surfaced by the logger fix in commit 1.

5. feat(net): opt-in signal-fallback connect enforcement for non-BPF-LSM kernels

   • --enforce-fallback=signal (default off): a sys_enter_connect tracepoint
     matches the existing network deny maps and, in enforce mode, kills the
     offending process via bpf_send_signal().
   • Config flag reuses one reserved byte of agent_config (size/offsets
     unchanged; static_assert(sizeof==48) holds). Threaded via a defaulted
     daemon_run param (no churn to other callers).
   • Verified on 6.17: the program passes the verifier and attaches; a connect to
     a denied IP with --enforce-signal=none is killed by SIGKILL
     (net_connect_block action=KILL, protocol=0 — distinct from the LSM hook's
     action=BLOCK), allowed IPs unaffected.
   • Caveat (documented in GUARANTEES.md): on genuinely LSM-absent hosts the
     enforce-gate still treats the missing LSM hook as a degradation; teaching the
     gate to accept signal-fallback as primary enforcement there is a follow-up.
     Today it's verified as opt-in defense-in-depth alongside LSM enforcement.

Verification

• Fresh build clean under -Werror; full ctest 292/293 (1 = crypto-review gate).
• BPF object loads + attaches all programs on kernel 6.17; end-to-end connect
  block + signal-fallback kill confirmed against a TEST-NET-2 IP (198.51.100.7).
• Go operator unaffected (not touched).

Not included

• operator/go.mod / operator/go.sum were already modified before this work
  (pre-existing go mod tidy) and are intentionally excluded.

🤖 Generated with Claude Code

[Copilot]

Pull request overview

This PR hardens userspace build/logging/fuzzing posture, corrects optional BPF-LSM hook detection, and adds an opt-in tracepoint signal fallback for network connect enforcement.

Changes:

• Adds logger const char* field handling with regression tests and adjusts policy generation bump timing.
• Strengthens compiler hardening and introduces ClusterFuzzLite PR fuzzing infrastructure.
• Updates BPF/daemon/CLI/config plumbing for optional signal fallback and revises enforcement documentation.

Reviewed changes

Copilot reviewed 19 out of 19 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
tests/test_logging.cpp	Adds structured logger overload regression tests.
src/logging.hpp	Adds const char* field overload.
src/policy_runtime.cpp	Moves generation bump to the direct-apply mutation window.
src/types.hpp	Adds signal_fallback_enforce to userspace agent config layout.
bpf/aegis_common.h	Mirrors the new BPF agent config field/default.
src/daemon.hpp	Extends daemon_run with fallback flag.
src/daemon.cpp	Writes fallback enablement into agent config.
src/cli_run.cpp	Parses --enforce-fallback.
src/bpf_ops.cpp	Changes optional LSM BTF detection to prefixed symbols.
src/bpf_attach.cpp	Attaches the signal-fallback tracepoint program.
bpf/aegis_net.bpf.h	Adds sys_enter_connect signal-fallback enforcement logic.
CMakeLists.txt	Adds hardening probes, logging test, CLI test, and fuzz target loop.
.github/workflows/cflite-pr.yml	Adds ClusterFuzzLite PR workflow.
.clusterfuzzlite/project.yaml	Defines CFLite project metadata.
.clusterfuzzlite/Dockerfile	Defines CFLite/OSS-Fuzz build image.
.clusterfuzzlite/build.sh	Builds and exports fuzzers for CFLite.
README.md	Aligns enforcement and hardening claims.
docs/GUARANTEES.md	Documents async OverlayFS and signal-fallback guarantees.
docs/MEMORY_SAFETY.md	Adds memory-safety posture documentation.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.