Skip to main content

Module ebpf

aa_security::policy

Module ebpf 

Source
Expand description

Deterministic lowering of the canonical PolicyDocument into the flat rule set the eBPF maps consume (AAASM-3608).

The kernel layer is generated from the same policy the gateway enforces, never hand-maintained — this is the mechanism behind “one policy source → gateway + eBPF rules with no detectable enforcement gap”. The privileged loader daemon (AAASM-3603/3604) pushes the produced EbpfRuleSet into the PATH_BLOCKLIST / PATH_ALLOWLIST BPF maps over the control channel.

§What is enforceable in-kernel vs L7-only

The eBPF probes match on filesystem paths and (where wired) egress hosts. The lowering therefore covers exactly:

  • Filesystem path rules derived from tools.*.requires_approval_if predicates of the form path starts_with "<prefix>" (each becomes a PathVerdict::Deny PathRule) and from a capability file_write or file_delete deny (which seeds the well-known sensitive-path deny defaults — the kernel path probe cannot tell write from delete).
  • Egress allowlist copied verbatim from network.allowlist.

Everything else is explicitly L7-only and documented in L7_ONLY_DIMENSIONS so the cross-layer consistency test (AAASM-3609) can assert the gap is intentional and reviewed, never silent:

  • Budget / spend limits (budget)
  • Schedule / active-hours (schedule)
  • Credential / PII scanning + redaction (data)
  • Per-tool rate limits (tools.*.limit_per_hour)
  • Non-path CEL predicates (url contains, args.*, tool_result.*)
  • Capability categories with no path/host projection (agent_spawn, model:*, mcp_tool:*, network_inbound, terminal_exec)

Structs§

EbpfRuleSet
The flat rule set produced by lower_to_ebpf, consumed by the loader daemon’s map-update path.
PathRule
A single lowered filesystem path rule destined for a BPF path map.

Enums§

PathVerdict
Whether matching a path rule allows or denies the operation in-kernel.

Constants§

L7_ONLY_DIMENSIONS
Policy dimensions that are structurally not enforceable by the eBPF path/egress probes and are therefore enforced only at L7 by the gateway.

Functions§

lower_to_ebpf
Lower a canonical PolicyDocument to its EbpfRuleSet.