eBPF LSM runtime security agent for synchronous…
0 reactions
eBPF LSM runtime security agent for synchronous file/network denial — looking for technical feedback
I’m working on Aegis-BPF, an open-source Linux runtime security project built around eBPF LSM.
The goal is narrow: explore enforcement-first runtime security, where selected file and network operations can be denied before syscall completion, rather than only emitting post-event telemetry.
Current scope:
\- BPF-LSM based file/network policy decisions
\- cgroup-scoped policy
\- OverlayFS/copy-up handling
\- audit-mode fallback when enforcement is unavailable
\- Prometheus metrics
\- Kubernetes/Helm deployment path
I’m not claiming it is a production-ready replacement for Falco, Tetragon, or KubeArmor. I’m treating it as a focused enforcement model project and looking for criticism from people who understand eBPF, Linux security, or container runtime edge cases.
Main feedback I’m looking for:
\- Are the hook choices reasonable?
\- What enforcement edge cases am I probably missing?
\- What would make the failure-mode model more trustworthy?
\- What tests would you expect before taking this seriously?
\- Are there obvious problems with cgroup-scoped policy or OverlayFS handling?
Repo:
https://github.com/ErenAri/Aegis-BPF
Technical criticism is more useful than general encouragement.
#technology
I’m working on Aegis-BPF, an open-source Linux runtime security project built around eBPF LSM.
The goal is narrow: explore enforcement-first runtime security, where selected file and network operations can be denied before syscall completion, rather than only emitting post-event telemetry.
Current scope:
\- BPF-LSM based file/network policy decisions
\- cgroup-scoped policy
\- OverlayFS/copy-up handling
\- audit-mode fallback when enforcement is unavailable
\- Prometheus metrics
\- Kubernetes/Helm deployment path
I’m not claiming it is a production-ready replacement for Falco, Tetragon, or KubeArmor. I’m treating it as a focused enforcement model project and looking for criticism from people who understand eBPF, Linux security, or container runtime edge cases.
Main feedback I’m looking for:
\- Are the hook choices reasonable?
\- What enforcement edge cases am I probably missing?
\- What would make the failure-mode model more trustworthy?
\- What tests would you expect before taking this seriously?
\- Are there obvious problems with cgroup-scoped policy or OverlayFS handling?
Repo:
https://github.com/ErenAri/Aegis-BPF
Technical criticism is more useful than general encouragement.
#technology
| 2,000 mlx | |
| 3 | |
| 0 |