actplane-bpf 0.1.0

ActPlane eBPF loader: loads the prebuilt CO-RE object with aya, no clang/libbpf at runtime.
Documentation 
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31

/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
/* Copyright (c) 2026 eunomia-bpf org. */
#ifndef __PROCESS_H
#define __PROCESS_H

#define TASK_COMM_LEN 16
#define MAX_FILENAME_LEN 127

#include "taint.h"

/* The kernel emits exactly one kind of event: a taint-rule violation. */
enum event_type {
	EVENT_TYPE_TAINT_VIOLATION = 3,
};

struct event {
	enum event_type type;
	int pid;
	int ppid;
	unsigned int blocked;          /* 1 if an LSM hook denied the operation */
	unsigned int killed;           /* 1 if the rule sent SIGKILL */
	unsigned int effect;           /* enum taint_effect declared by the rule */
	unsigned long long timestamp_ns;
	char comm[TASK_COMM_LEN];
	char filename[MAX_FILENAME_LEN]; /* offending exe / path ("" for connect) */
	unsigned int taint_rule_id;
	unsigned int conn_ip;            /* connect: network-order IPv4 (0 otherwise) */
	unsigned long long taint_label;
};

#endif /* __PROCESS_H */