rootguard.bpf.c

Go to the documentation of this file.

// SPDX-License-Identifier: GPL-3.0-or-later
#include "vmlinux.h"
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_core_read.h>
#include <bpf/bpf_tracing.h>
#include "rootguard/rootguard_shared.h"
 
#ifndef EPERM
#define EPERM 1
#endif
#ifndef ATTR_MODE
#define ATTR_MODE (1U << 0)
#define ATTR_UID  (1U << 1)
#define ATTR_GID  (1U << 2)
#endif
#ifndef S_ISUID
#define S_ISUID 0004000
#define S_ISGID 0002000
#endif
#ifndef S_IWGRP
#define S_IWGRP 0000020
#define S_IWOTH 0000002
#endif
#ifndef S_IRUSR
#define S_IRUSR 0000400
#define S_IWUSR 0000200
#endif
 
char LICENSE[] SEC("license") = "GPL";
 
/*
 * Use the BTF-provided declaration whenever the target kernel exposes the
 * kfunc.  Its first argument changed from struct path * to const struct path *
 * across kernel versions, so redeclaring it unconditionally is not portable.
 * Keep a weak fallback declaration for kernels whose BTF has no such kfunc.
 */
#ifndef ROOTGUARD_VMLINUX_HAS_BPF_PATH_D_PATH
extern int bpf_path_d_path(const struct path *path, char *buf,
                           size_t buf__sz) __weak __ksym;
#endif
 
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 1 << 22); /* 4 MiB */
} events SEC(".maps");
 
/* Key: TGID. Populated by a future trusted authorization bridge. */
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 4096);
    __type(key, __u32);
    __type(value, struct rg_auth_token);
} auth_tokens SEC(".maps");
 
struct {
    __uint(type, BPF_MAP_TYPE_ARRAY);
    __uint(max_entries, 1);
    __type(key, __u32);
    __type(value, struct rg_kernel_config);
} rg_config_map SEC(".maps");
 
/* Exact executable identities, populated from policy by userspace. */
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 2048);
    __type(key, struct rg_file_key);
    __type(value, struct rg_rule_value);
} trusted_execs SEC(".maps");
 
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 2048);
    __type(key, struct rg_file_key);
    __type(value, struct rg_rule_value);
} denied_execs SEC(".maps");
 
/* Inodes whose ownership, mode and security metadata are protected. */
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 8192);
    __type(key, struct rg_file_key);
    __type(value, struct rg_protected_value);
} protected_inodes SEC(".maps");
 
struct rg_task_state {
    __u32 observed_nonroot;
    __u32 authorized_root;
    __u32 anomaly_reported;
    __u32 baseline_uid;
};
 
enum rg_pending_operation {
    RG_PENDING_NONE = 0,
    RG_PENDING_CHMOD = 1,
    RG_PENDING_CHOWN = 2,
};
 
struct rg_exec_context {
    struct rg_file_key executable;
    __u64 start_boottime_ns;
    char executable_path[RG_FILENAME_LEN];
};
 
struct rg_pending_path {
    struct rg_file_key file;
    __u32 operation;
    __u32 reserved;
    char path[RG_FILENAME_LEN];
};
 
/*
 * Aggregate by execution domain, not by cgroup alone: desktop applications may
 * share a broad systemd user slice. Actor+parent executable identities keep a
 * backup helper from consuming the cooldown of an unrelated process. Protected
 * identities never use this limiter.
 */
struct rg_metadata_domain_key {
    __u64 cgroup_id;
    struct rg_file_key actor;
    struct rg_file_key parent;
    __u32 tgid_fallback;
    __u32 reserved;
};
 
struct rg_metadata_domain_state {
    struct bpf_spin_lock lock;
    __u32 reserved;
    __u64 window_start_ns;
    __u64 last_burst_ns;
    __u32 destructive_count;
    __u32 sampled_events;
};
 
/*
 * bpf_spin_lock is only supported in HASH/ARRAY map values.  Keep this a
 * bounded HASH (rather than LRU_HASH) so the verifier can associate the BTF
 * spin-lock metadata with each value.  Execution-domain cardinality is low on
 * a desktop because actor/parent executable inode identities are stable; the
 * map is also cleared on every successful policy swap.
 */
struct {
    __uint(type, BPF_MAP_TYPE_HASH);
    __uint(max_entries, 32768);
    __type(key, struct rg_metadata_domain_key);
    __type(value, struct rg_metadata_domain_state);
} metadata_domain_states SEC(".maps");
 
#define RG_METADATA_DECISION_SAMPLE (1U << 0)
#define RG_METADATA_DECISION_BURST  (1U << 1)
 
/*
 * Exec identity is captured while the task is alive, avoiding the /proc race
 * that occurs when short-lived helpers exit before userspace drains the ring.
 */
struct {
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
    __uint(max_entries, 65536);
    __type(key, __u32); /* TGID */
    __type(value, struct rg_exec_context);
} exec_contexts SEC(".maps");
 
/*
 * path_chmod/path_chown receive a complete struct path. The exact path is
 * cached for the following inode_setattr hook in the same task.
 */
struct {
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
    __uint(max_entries, 16384);
    __type(key, __u64); /* PID/TGID pair */
    __type(value, struct rg_pending_path);
} pending_paths SEC(".maps");
 
/*
 * A second signal independent from the credential-transition hooks.  It keeps
 * the fact that a task was previously observed as non-root.  If an exploit
 * mutates cred directly and later asks the kernel for a capability, the
 * capable hook can still identify the inconsistent state.
 */
struct {
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
    __uint(max_entries, 65536);
    __type(key, __u64); /* task_struct address */
    __type(value, struct rg_task_state);
} task_states SEC(".maps");
 
static __always_inline __u32 cred_uid(const struct cred *cred)
{
    kuid_t uid = {};
 
    if (!cred)
        return (__u32)-1;
 
    BPF_CORE_READ_INTO(&uid, cred, uid);
    return uid.val;
}
 
static __always_inline __u32 cred_euid(const struct cred *cred)
{
    kuid_t euid = {};
 
    if (!cred)
        return (__u32)-1;
 
    BPF_CORE_READ_INTO(&euid, cred, euid);
    return euid.val;
}
 
static __always_inline const struct cred *current_cred_ptr(void)
{
    struct task_struct *task =
        (struct task_struct *)bpf_get_current_task_btf();
 
    return BPF_CORE_READ(task, cred);
}
 
static __always_inline __u32 current_euid_value(void)
{
    return cred_euid(current_cred_ptr());
}
 
static __always_inline void current_ids(__u32 *pid, __u32 *tgid, __u32 *ppid)
{
    __u64 id = bpf_get_current_pid_tgid();
    struct task_struct *task = (struct task_struct *)bpf_get_current_task_btf();
    struct task_struct *parent = BPF_CORE_READ(task, real_parent);
 
    *pid = (__u32)id;
    *tgid = (__u32)(id >> 32);
    *ppid = parent ? (__u32)BPF_CORE_READ(parent, tgid) : 0;
}
 
static __always_inline const struct rg_kernel_config *kernel_config(void)
{
    __u32 key = 0;
    return bpf_map_lookup_elem(&rg_config_map, &key);
}
 
static __always_inline bool current_executable_key(struct rg_file_key *key);
static __always_inline bool parent_executable_key(struct rg_file_key *key);
 
/*
 * Return SAMPLE while this execution domain is inside its small forensic
 * sample budget, and BURST once a destructive metadata pattern crosses the
 * configured threshold.
 * The burst notification has its own long cooldown; counting continues without
 * sending one ring-buffer record per file.
 */
static __always_inline __u32 observe_unprotected_metadata(bool count_burst_candidate,
                                                           bool request_sample,
                                                           __u32 *burst_count)
{
    const struct rg_kernel_config *cfg = kernel_config();
    struct rg_metadata_domain_state initial = {};
    struct rg_metadata_domain_state *state;
    struct rg_metadata_domain_key key = {};
    __u64 now, window_ns, cooldown_ns;
    __u32 monitor_global, detect_bursts, sample_limit, burst_threshold;
    __u32 decision = 0;
 
    if (burst_count)
        *burst_count = 0;
    if (!cfg)
        return 0;
 
    /* Copy config scalars before taking a map-value spin lock. */
    monitor_global = cfg->monitor_global_privilege_metadata;
    detect_bursts = cfg->detect_global_metadata_bursts;
    sample_limit = cfg->global_metadata_sample_limit;
    burst_threshold = cfg->metadata_burst_threshold;
    window_ns = (__u64)cfg->metadata_burst_window_ms * 1000000ULL;
    cooldown_ns = (__u64)cfg->metadata_burst_cooldown_ms * 1000000ULL;
    if (!monitor_global && !detect_bursts)
        return 0;
 
    key.cgroup_id = bpf_get_current_cgroup_id();
    if (!current_executable_key(&key.actor))
        key.tgid_fallback = (__u32)(bpf_get_current_pid_tgid() >> 32);
    (void)parent_executable_key(&key.parent);
    now = bpf_ktime_get_ns();
    if (window_ns == 0)
        window_ns = 5000000000ULL;
    if (cooldown_ns < window_ns)
        cooldown_ns = window_ns;
 
    state = bpf_map_lookup_elem(&metadata_domain_states, &key);
    if (!state) {
        initial.window_start_ns = now;
        bpf_map_update_elem(&metadata_domain_states, &key, &initial, BPF_NOEXIST);
        state = bpf_map_lookup_elem(&metadata_domain_states, &key);
        if (!state)
            return 0;
    }
 
    /* Multiple workers in one service/cgroup may run on different CPUs. */
    bpf_spin_lock(&state->lock);
 
    if (state->window_start_ns == 0 ||
        now - state->window_start_ns >= window_ns) {
        state->window_start_ns = now;
        state->destructive_count = 0;
        state->sampled_events = 0;
    }
 
    if (request_sample && monitor_global &&
        state->sampled_events < sample_limit) {
        ++state->sampled_events;
        decision |= RG_METADATA_DECISION_SAMPLE;
    }
 
    if (count_burst_candidate && detect_bursts) {
        if (state->destructive_count != (__u32)-1)
            ++state->destructive_count;
        if (state->destructive_count >= burst_threshold &&
            (state->last_burst_ns == 0 ||
             now - state->last_burst_ns >= cooldown_ns)) {
            state->last_burst_ns = now;
            decision |= RG_METADATA_DECISION_BURST;
            if (burst_count)
                *burst_count = state->destructive_count;
        }
    }
 
    bpf_spin_unlock(&state->lock);
    return decision;
}
 
/*
 * Clang normally lowers `blocked ? -EPERM : 0` to a boolean followed by a
 * 64-bit NEG instruction. Some verifier versions lose the signed bounds of
 * that value and reject an otherwise valid LSM return. The compiler barrier
 * keeps two constant-return control-flow paths: exactly -EPERM or 0.
 */
static __always_inline int lsm_result_from_verdict(__u32 verdict)
{
    if (verdict == RG_VERDICT_BLOCKED) {
        asm volatile("" ::: "memory");
        return -EPERM;
    }
 
    return 0;
}
 
static __always_inline bool file_key_from_inode(const struct inode *inode,
                                                struct rg_file_key *key)
{
    struct super_block *superblock;
 
    if (!inode || !key)
        return false;
 
    superblock = BPF_CORE_READ(inode, i_sb);
    if (!superblock)
        return false;
 
    key->inode = BPF_CORE_READ(inode, i_ino);
    key->device = BPF_CORE_READ(superblock, s_dev);
    return key->inode != 0;
}
 
static __always_inline bool file_key_from_file(const struct file *file,
                                               struct rg_file_key *key)
{
    struct inode *inode;
 
    if (!file || !key)
        return false;
 
    inode = BPF_CORE_READ(file, f_inode);
    return file_key_from_inode(inode, key);
}
 
static __always_inline bool file_key_from_dentry(const struct dentry *dentry,
                                                 struct rg_file_key *key)
{
    struct inode *inode;
 
    if (!dentry || !key)
        return false;
 
    inode = BPF_CORE_READ(dentry, d_inode);
    return file_key_from_inode(inode, key);
}
 
static __always_inline const char *dentry_name_ptr(const struct dentry *dentry)
{
    if (!dentry)
        return 0;
    return (const char *)BPF_CORE_READ(dentry, d_name.name);
}
 
static __always_inline bool current_executable_key(struct rg_file_key *key)
{
    struct task_struct *task;
    struct mm_struct *mm;
    struct file *file;
 
    task = (struct task_struct *)bpf_get_current_task_btf();
    mm = BPF_CORE_READ(task, mm);
    if (!mm)
        return false;
 
    file = BPF_CORE_READ(mm, exe_file);
    return file_key_from_file(file, key);
}
 
static __always_inline bool parent_executable_key(struct rg_file_key *key)
{
    struct task_struct *task, *parent;
    struct mm_struct *mm;
    struct file *file;
 
    if (!key)
        return false;
    task = (struct task_struct *)bpf_get_current_task_btf();
    if (!task)
        return false;
    parent = BPF_CORE_READ(task, real_parent);
    if (!parent)
        return false;
    mm = BPF_CORE_READ(parent, mm);
    if (!mm)
        return false;
    file = BPF_CORE_READ(mm, exe_file);
    return file_key_from_file(file, key);
}
 
static __always_inline bool file_key_equal(const struct rg_file_key *left,
                                           const struct rg_file_key *right)
{
    return left && right &&
           left->device == right->device &&
           left->inode == right->inode;
}
 
static __always_inline void copy_map_string(char *destination,
                                            const char *source,
                                            __u32 size)
{
    if (!destination || !source || size == 0)
        return;
    if (size == RG_FILENAME_LEN)
        __builtin_memcpy_inline(destination, source, RG_FILENAME_LEN);
    else if (size == RG_COMM_LEN)
        __builtin_memcpy_inline(destination, source, RG_COMM_LEN);
}
 
static __always_inline void capture_exec_context(struct linux_binprm *bprm,
                                                 const struct rg_file_key *key)
{
    struct rg_exec_context context = {};
    struct task_struct *task;
    const char *filename;
    __u64 ids;
    __u32 tgid;
 
    if (!bprm)
        return;
 
    ids = bpf_get_current_pid_tgid();
    tgid = (__u32)(ids >> 32);
    if (tgid == 0)
        return;
 
    if (key)
        context.executable = *key;
 
    task = (struct task_struct *)bpf_get_current_task_btf();
    if (task)
        context.start_boottime_ns = BPF_CORE_READ(task, start_boottime);
 
    /*
     * bprm->filename is captured synchronously at exec time. The executable
     * device/inode above remains the authoritative identity even when this
     * string is relative or later renamed.
     */
    filename = BPF_CORE_READ(bprm, filename);
    if (filename)
        bpf_probe_read_kernel_str(context.executable_path,
                                  sizeof(context.executable_path),
                                  filename);
    bpf_map_update_elem(&exec_contexts, &tgid, &context, BPF_ANY);
}
 
static __always_inline bool runtime_path_is_run(const char *path)
{
    if (!path)
        return false;
 
    /* Match /run and /run/... but not /runtime, /runner, etc. */
    return path[0] == '/' && path[1] == 'r' && path[2] == 'u' &&
           path[3] == 'n' && (path[4] == '\0' || path[4] == '/');
}
 
static __always_inline bool pending_path_is_under_run(
    const struct rg_file_key *file_key)
{
    __u64 ids = bpf_get_current_pid_tgid();
    struct rg_pending_path *pending =
        bpf_map_lookup_elem(&pending_paths, &ids);
 
    if (!pending || !file_key_equal(file_key, &pending->file))
        return false;
 
    return runtime_path_is_run(pending->path);
}
 
static __always_inline void discard_pending_path(void)
{
    __u64 ids = bpf_get_current_pid_tgid();
    bpf_map_delete_elem(&pending_paths, &ids);
}
 
static __always_inline void record_pending_path(const struct path *path,
                                                __u32 operation)
{
    struct rg_pending_path pending = {};
    __u64 ids;
 
    if (!path || !bpf_path_d_path)
        return;
    if (!file_key_from_dentry(BPF_CORE_READ(path, dentry), &pending.file))
        return;
    /*
     * Older BTF declares the first argument as struct path *, while newer
     * kernels const-qualify it.  A mutable pointer is accepted by both forms.
     */
    if (bpf_path_d_path((struct path *)path, pending.path,
                        sizeof(pending.path)) <= 0)
        return;
 
    pending.operation = operation;
    ids = bpf_get_current_pid_tgid();
    bpf_map_update_elem(&pending_paths, &ids, &pending, BPF_ANY);
}
 
static __always_inline bool consume_pending_path(
    const struct rg_file_key *file_key, char *destination,
    __u32 *path_resolution)
{
    __u64 ids = bpf_get_current_pid_tgid();
    struct rg_pending_path *pending =
        bpf_map_lookup_elem(&pending_paths, &ids);
 
    if (!pending)
        return false;
 
    if (!file_key_equal(file_key, &pending->file)) {
        bpf_map_delete_elem(&pending_paths, &ids);
        return false;
    }
 
    __builtin_memcpy_inline(destination, pending->path, RG_FILENAME_LEN);
    *path_resolution = RG_PATH_LSM_EXACT;
    bpf_map_delete_elem(&pending_paths, &ids);
    return true;
}
 
static __always_inline void enrich_event_actor(struct rg_event *event)
{
    struct task_struct *task;
    struct task_struct *parent;
    struct rg_exec_context *context;
    struct rg_exec_context *parent_context;
    __u32 tgid;
 
    if (!event)
        return;
 
    tgid = event->tgid;
    if (current_executable_key(&event->actor_file)) {
        /* Exact executable identity is always captured at event time. */
    }
 
    task = (struct task_struct *)bpf_get_current_task_btf();
    if (task) {
        event->actor_start_boottime_ns =
            BPF_CORE_READ(task, start_boottime);
        parent = BPF_CORE_READ(task, real_parent);
        if (parent)
            bpf_core_read_str(event->parent_comm,
                              sizeof(event->parent_comm),
                              &parent->comm);
    }
 
    context = bpf_map_lookup_elem(&exec_contexts, &tgid);
    if (context) {
        if (event->actor_file.inode == 0)
            event->actor_file = context->executable;
        if (event->actor_start_boottime_ns == 0)
            event->actor_start_boottime_ns = context->start_boottime_ns;
        copy_map_string(event->actor_executable, context->executable_path,
                        RG_FILENAME_LEN);
    }
 
    if (event->ppid == 0)
        return;
    parent_context = bpf_map_lookup_elem(&exec_contexts, &event->ppid);
    if (!parent_context)
        return;
    event->parent_file = parent_context->executable;
    copy_map_string(event->parent_executable,
                    parent_context->executable_path,
                    RG_FILENAME_LEN);
}
 
static __always_inline __u64 task_key(const struct task_struct *task)
{
    return (__u64)(unsigned long)task;
}
 
static __always_inline void observe_task(struct task_struct *task,
                                         __u32 uid, __u32 euid)
{
    __u64 key;
    struct rg_task_state state = {};
    struct rg_task_state *existing;
 
    if (!task)
        return;
 
    key = task_key(task);
    existing = bpf_map_lookup_elem(&task_states, &key);
 
    if (euid != 0) {
        /*
         * The effective UID determines whether the task can exercise root
         * privileges.  A legitimate setuid-root process normally keeps the
         * caller's real UID, so testing uid != 0 here would erase an
         * authorization immediately after sudo/pkexec gained EUID 0.
         */
        /* inode_permission is hot: avoid rewriting an unchanged state. */
        if (existing && existing->observed_nonroot &&
            !existing->authorized_root &&
            existing->baseline_uid == uid)
            return;
 
        if (existing)
            state = *existing;
        state.observed_nonroot = 1;
        state.authorized_root = 0;
        state.anomaly_reported = 0;
        state.baseline_uid = uid;
        bpf_map_update_elem(&task_states, &key, &state, BPF_ANY);
        return;
    }
 
    /* Root tasks are inserted by task_alloc/authorized transitions only. */
    if (!existing)
        bpf_map_update_elem(&task_states, &key, &state, BPF_ANY);
}
 
static __always_inline void observe_current_task(const struct cred *cred)
{
    struct task_struct *task =
        (struct task_struct *)bpf_get_current_task_btf();
    observe_task(task, cred_uid(cred), cred_euid(cred));
}
 
static __always_inline void mark_current_authorized_root(void)
{
    struct task_struct *task =
        (struct task_struct *)bpf_get_current_task_btf();
    __u64 key = task_key(task);
    struct rg_task_state state = {};
    struct rg_task_state *existing =
        bpf_map_lookup_elem(&task_states, &key);
 
    if (existing)
        state = *existing;
    state.authorized_root = 1;
    state.anomaly_reported = 0;
    bpf_map_update_elem(&task_states, &key, &state, BPF_ANY);
}
 
static __always_inline bool consume_token_for(__u32 tgid, __u32 ppid,
                                              __u32 target_euid)
{
    __u64 now = bpf_ktime_get_ns();
    struct rg_auth_token *token;
    bool valid;
 
    token = bpf_map_lookup_elem(&auth_tokens, &tgid);
    if (token) {
        valid = token->expires_ns >= now && token->target_euid == target_euid;
        bpf_map_delete_elem(&auth_tokens, &tgid);
        if (valid)
            return true;
    }
 
    token = bpf_map_lookup_elem(&auth_tokens, &ppid);
    if (token) {
        valid = token->expires_ns >= now && token->target_euid == target_euid;
        bpf_map_delete_elem(&auth_tokens, &ppid);
        if (valid)
            return true;
    }
 
    return false;
}
 
static __always_inline __u32 decide_escalation(
    const struct rg_file_key *file_key, bool have_file_key, bool authorized,
    __u32 *reason_flags, __u32 *rule_id)
{
    const struct rg_kernel_config *cfg;
    struct rg_rule_value *rule;
 
    *reason_flags = RG_REASON_NONE;
    *rule_id = 0;
 
    if (authorized) {
        *reason_flags = RG_REASON_AUTH_TOKEN;
        return RG_VERDICT_AUTHORIZED;
    }
 
    if (!have_file_key) {
        *reason_flags = RG_REASON_FILE_ID_UNAVAILABLE | RG_REASON_UNKNOWN_EXEC;
    } else {
        rule = bpf_map_lookup_elem(&denied_execs, file_key);
        if (rule) {
            *reason_flags = RG_REASON_DENIED_EXEC;
            *rule_id = rule->rule_id;
            cfg = kernel_config();
            return cfg && cfg->mode == RG_MODE_ENFORCE
                       ? RG_VERDICT_BLOCKED
                       : RG_VERDICT_AUDIT;
        }
 
        rule = bpf_map_lookup_elem(&trusted_execs, file_key);
        if (rule) {
            *reason_flags = RG_REASON_TRUSTED_EXEC;
            *rule_id = rule->rule_id;
            return RG_VERDICT_TRUSTED;
        }
 
        *reason_flags = RG_REASON_UNKNOWN_EXEC;
    }
 
    cfg = kernel_config();
    if (cfg && cfg->mode == RG_MODE_ENFORCE &&
        cfg->unknown_action == RG_ACTION_BLOCK)
        return RG_VERDICT_BLOCKED;
 
    return RG_VERDICT_AUDIT;
}
 
static __always_inline __u32 metadata_verdict(bool protected_change,
                                                bool protected_audit_only,
                                                bool global_change)
{
    const struct rg_kernel_config *cfg = kernel_config();
 
    if (!cfg || cfg->mode != RG_MODE_ENFORCE)
        return RG_VERDICT_AUDIT;
    if (protected_change && !protected_audit_only &&
        cfg->metadata_action == RG_ACTION_BLOCK)
        return RG_VERDICT_BLOCKED;
    if (global_change && cfg->global_metadata_action == RG_ACTION_BLOCK)
        return RG_VERDICT_BLOCKED;
    return RG_VERDICT_AUDIT;
}
 
static __always_inline void emit_event(
    __u32 type, __u32 verdict, __u32 reason_flags, __u32 rule_id,
    __u32 old_euid, __u32 new_euid, __s32 flags, __u32 auxiliary,
    const struct rg_file_key *file_key, const char *kernel_filename,
    const char *kernel_xattr, __u32 old_mode, __u32 new_mode,
    __u32 old_uid, __u32 new_uid, __u32 old_gid, __u32 new_gid)
{
    const struct rg_kernel_config *cfg;
    struct rg_event *event;
 
    if (verdict == RG_VERDICT_TRUSTED) {
        cfg = kernel_config();
        if (cfg && cfg->log_trusted == 0)
            return;
    }
 
    event = bpf_ringbuf_reserve(&events, sizeof(*event), 0);
    if (!event)
        return;
 
    __builtin_memset(event, 0, sizeof(*event));
    event->timestamp_ns = bpf_ktime_get_ns();
    current_ids(&event->pid, &event->tgid, &event->ppid);
    event->old_euid = old_euid;
    event->new_euid = new_euid;
    event->event_type = type;
    event->verdict = verdict;
    event->reason_flags = reason_flags;
    event->rule_id = rule_id;
    event->lsm_flags = flags;
    event->auxiliary = auxiliary;
    event->old_mode = old_mode;
    event->new_mode = new_mode;
    event->old_uid = old_uid;
    event->new_uid = new_uid;
    event->old_gid = old_gid;
    event->new_gid = new_gid;
    if (file_key)
        event->file = *file_key;
    bpf_get_current_comm(event->comm, sizeof(event->comm));
    enrich_event_actor(event);
 
    if (!consume_pending_path(file_key, event->filename,
                              &event->path_resolution) &&
        kernel_filename) {
        bpf_probe_read_kernel_str(event->filename,
                                  sizeof(event->filename),
                                  kernel_filename);
        event->path_resolution = RG_PATH_BASENAME;
    }
    if (kernel_xattr)
        bpf_probe_read_kernel_str(event->xattr_name,
                                  sizeof(event->xattr_name),
                                  kernel_xattr);
 
    bpf_ringbuf_submit(event, 0);
}
 
static __always_inline int xattr_kind(const char *name)
{
    char value[RG_XATTR_NAME_LEN] = {};
 
    if (!name)
        return 0;
    if (bpf_probe_read_kernel_str(value, sizeof(value), name) <= 0)
        return 0;
 
    if (__builtin_memcmp(value, "security.capability", 20) == 0)
        return 1;
    if (__builtin_memcmp(value, "security.ima", 13) == 0 ||
        __builtin_memcmp(value, "security.evm", 13) == 0)
        return 2;
    if (__builtin_memcmp(value, "security.selinux", 17) == 0 ||
        __builtin_memcmp(value, "security.apparmor", 18) == 0)
        return 3;
    return 0;
}
 
static __always_inline void inode_metadata(const struct inode *inode,
                                           __u32 *mode, __u32 *uid, __u32 *gid)
{
    kuid_t inode_uid = {};
    kgid_t inode_gid = {};
 
    *mode = BPF_CORE_READ(inode, i_mode) & 07777U;
    BPF_CORE_READ_INTO(&inode_uid, inode, i_uid);
    BPF_CORE_READ_INTO(&inode_gid, inode, i_gid);
    *uid = inode_uid.val;
    *gid = inode_gid.val;
}
 
/* Inherit the task provenance marker across fork/clone. */
SEC("lsm/task_alloc")
int BPF_PROG(rg_task_alloc, struct task_struct *task,
             unsigned long clone_flags, int ret)
{
    struct task_struct *current;
    const struct cred *cred;
    struct rg_task_state state = {};
    struct rg_task_state *parent_state;
    __u64 parent_key, child_key;
 
    /*
     * The chained LSM result arrives through a u64 tracing-context slot.
     * Some Clang/verifier combinations lose the signed 32-bit range when
     * returning that dynamic value directly.  Never override a previous
     * denial: normalize it to a verifier-safe negative errno instead.
     */
    if (ret)
        return -EPERM;
 
    current = (struct task_struct *)bpf_get_current_task_btf();
    parent_key = task_key(current);
    child_key = task_key(task);
    parent_state = bpf_map_lookup_elem(&task_states, &parent_key);
    if (parent_state) {
        state = *parent_state;
    } else {
        cred = BPF_CORE_READ(current, cred);
        state.observed_nonroot = cred_euid(cred) != 0;
        state.baseline_uid = cred_uid(cred);
    }
 
    bpf_map_update_elem(&task_states, &child_key, &state, BPF_ANY);
    return 0;
}
 
/* Covers setuid()/setresuid()-style credential transitions. */
SEC("lsm/task_fix_setuid")
int BPF_PROG(rg_task_fix_setuid, struct cred *new, const struct cred *old,
             int flags, int ret)
{
    struct rg_file_key file_key = {};
    __u32 old_euid, new_euid, pid, tgid, ppid;
    __u32 reason_flags, rule_id, verdict;
    bool authorized, have_file_key;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    observe_current_task(old);
    old_euid = cred_euid(old);
    new_euid = cred_euid(new);
 
    /* A root service dropping to a user must establish a non-root baseline. */
    if (new_euid != 0) {
        struct task_struct *task =
            (struct task_struct *)bpf_get_current_task_btf();
        observe_task(task, cred_uid(new), new_euid);
        return 0;
    }
    if (old_euid == 0)
        return 0;
 
    current_ids(&pid, &tgid, &ppid);
    authorized = consume_token_for(tgid, ppid, new_euid);
    have_file_key = current_executable_key(&file_key);
    verdict = decide_escalation(&file_key, have_file_key, authorized,
                                &reason_flags, &rule_id);
 
    if (verdict == RG_VERDICT_AUTHORIZED || verdict == RG_VERDICT_TRUSTED)
        mark_current_authorized_root();
 
    emit_event(RG_EVENT_SETUID, verdict, reason_flags, rule_id,
               old_euid, new_euid, flags, 0,
               have_file_key ? &file_key : 0, 0, 0,
               0, 0, 0, 0, 0, 0);
 
    return lsm_result_from_verdict(verdict);
}
 
/* Covers privilege changes prepared during exec, including setuid/file caps. */
SEC("lsm/bprm_check_security")
int BPF_PROG(rg_bprm_check_security, struct linux_binprm *bprm, int ret)
{
    struct task_struct *task;
    const struct cred *old_cred;
    const struct cred *new_cred;
    const struct file *file;
    const char *filename;
    struct rg_file_key file_key = {};
    __u32 old_euid, new_euid, pid, tgid, ppid;
    __u32 reason_flags, rule_id, verdict;
    bool authorized, have_file_key;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    task = (struct task_struct *)bpf_get_current_task_btf();
    old_cred = BPF_CORE_READ(task, cred);
    observe_current_task(old_cred);
    new_cred = BPF_CORE_READ(bprm, cred);
    old_euid = cred_euid(old_cred);
    new_euid = cred_euid(new_cred);
 
    /*
     * Capture every exec, not only privilege transitions. Short-lived tools
     * such as chmod/chown may exit before userspace can read /proc/<pid>/exe.
     */
    file = BPF_CORE_READ(bprm, file);
    have_file_key = file_key_from_file(file, &file_key);
    capture_exec_context(bprm, have_file_key ? &file_key : 0);
 
    if (new_euid != 0) {
        observe_task(task, cred_uid(new_cred), new_euid);
        return 0;
    }
    if (old_euid == 0)
        return 0;
 
    current_ids(&pid, &tgid, &ppid);
    authorized = consume_token_for(tgid, ppid, new_euid);
    verdict = decide_escalation(&file_key, have_file_key, authorized,
                                &reason_flags, &rule_id);
    filename = BPF_CORE_READ(bprm, filename);
 
    if (verdict == RG_VERDICT_AUTHORIZED || verdict == RG_VERDICT_TRUSTED)
        mark_current_authorized_root();
 
    emit_event(RG_EVENT_EXEC_PRIV, verdict, reason_flags, rule_id,
               old_euid, new_euid, 0, 0,
               have_file_key ? &file_key : 0, filename, 0,
               0, 0, 0, 0, 0, 0);
 
    return lsm_result_from_verdict(verdict);
}
 
/*
 * A direct cred overwrite may bypass task_fix_setuid.  The provenance guard is
 * therefore invoked from several independent authorization surfaces.  A task
 * previously observed as non-root must have crossed an authorized transition
 * before it is allowed to use UID 0.
 */
static __always_inline int guard_current_root_provenance(
    __u32 auxiliary, __s32 operation_flags,
    const struct rg_file_key *file_key)
{
    struct task_struct *task;
    const struct cred *cred;
    struct rg_task_state *state;
    const struct rg_kernel_config *cfg;
    __u64 key;
    __u32 uid, euid, verdict;
 
    task = (struct task_struct *)bpf_get_current_task_btf();
    cred = BPF_CORE_READ(task, cred);
    uid = cred_uid(cred);
    euid = cred_euid(cred);
 
    if (euid != 0) {
        observe_task(task, uid, euid);
        return 0;
    }
 
    key = task_key(task);
    state = bpf_map_lookup_elem(&task_states, &key);
    if (!state || !state->observed_nonroot || state->authorized_root)
        return 0;
 
    /*
     * File-based setuid credentials can already be active before
     * bprm_check_security observes the final EUID.  Resolve the current
     * executable here as a verifier-safe fallback.  The userspace loader
     * admits only exact, root-owned, non-writable device+inode identities.
     */
    {
        struct rg_file_key executable_key = {};
        struct rg_rule_value *trusted_rule;
 
        if (current_executable_key(&executable_key)) {
            trusted_rule = bpf_map_lookup_elem(&trusted_execs,
                                               &executable_key);
            if (trusted_rule) {
                state->authorized_root = 1;
                state->anomaly_reported = 0;
                return 0;
            }
        }
    }
 
    cfg = kernel_config();
    verdict = cfg && cfg->mode == RG_MODE_ENFORCE &&
                      cfg->credential_action == RG_ACTION_BLOCK
                  ? RG_VERDICT_BLOCKED
                  : RG_VERDICT_AUDIT;
 
    if (!state->anomaly_reported) {
        state->anomaly_reported = 1;
        emit_event(RG_EVENT_CREDENTIAL_ANOMALY, verdict,
                   RG_REASON_DIRECT_CRED_ANOMALY, 0,
                   state->baseline_uid, euid, operation_flags,
                   auxiliary, file_key, 0, 0,
                   0, 0, uid, uid, 0, 0);
    }
 
    return lsm_result_from_verdict(verdict);
}
 
SEC("lsm/capable")
int BPF_PROG(rg_capable, const struct cred *cred, struct user_namespace *ns,
             int cap, unsigned int opts, int ret)
{
    const struct cred *current_cred;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    current_cred = current_cred_ptr();
    if (cred != current_cred)
        return 0;
 
    return guard_current_root_provenance((__u32)cap, (__s32)opts, 0);
}
 
/*
 * Filesystem permission checks are a second interception point after a direct
 * cred overwrite.  This catches many attacks before they can modify a file,
 * even when no explicit capable() check is reached on the exact path.
 */
SEC("lsm/inode_permission")
int BPF_PROG(rg_inode_permission, struct inode *inode, int mask, int ret)
{
    struct rg_file_key key = {};
    bool have_key;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    have_key = file_key_from_inode(inode, &key);
    return guard_current_root_provenance((__u32)mask, mask,
                                         have_key ? &key : 0);
}
 
/* Also cover access through an already resolved struct file. */
SEC("lsm/file_open")
int BPF_PROG(rg_file_open, struct file *file, int ret)
{
    struct rg_file_key key = {};
    bool have_key;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    have_key = file_key_from_file(file, &key);
    return guard_current_root_provenance(0, 0,
                                         have_key ? &key : 0);
}
 
SEC("lsm/path_chmod")
int BPF_PROG(rg_path_chmod, const struct path *path, umode_t mode, int ret)
{
    if (ret)
        return -EPERM;
    record_pending_path(path, RG_PENDING_CHMOD);
    return 0;
}
 
SEC("lsm/path_chown")
int BPF_PROG2(rg_path_chown,
              const struct path *, path,
              kuid_t, uid,
              kgid_t, gid,
              int, ret)
{
    /* kuid_t/kgid_t are small struct-by-value arguments.  BPF_PROG performs
     * scalar casts from ctx[] and therefore cannot materialise them.  Use
     * BPF_PROG2, which accounts for aggregate arguments in the trampoline
     * context.  The values are not needed here; inode_setattr records the
     * resulting owner metadata change.
     */
    (void)uid;
    (void)gid;
 
    if (ret)
        return -EPERM;
    record_pending_path(path, RG_PENDING_CHOWN);
    return 0;
}
 
SEC("lsm/inode_setattr")
int BPF_PROG(rg_inode_setattr, struct mnt_idmap *idmap,
             struct dentry *dentry, struct iattr *attr, int ret)
{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    const struct rg_kernel_config *cfg;
    struct inode *inode;
    __u32 old_mode, new_mode, old_uid, new_uid, old_gid, new_gid;
    __u32 valid, reasons = 0, protected_reasons = 0, global_reasons = 0;
    __u32 verdict, event_type, metadata_decision = 0, burst_count = 0;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    if (!file_key_from_dentry(dentry, &key))
        return 0;
 
    inode = BPF_CORE_READ(dentry, d_inode);
    inode_metadata(inode, &old_mode, &old_uid, &old_gid);
    valid = BPF_CORE_READ(attr, ia_valid);
    new_mode = old_mode;
    new_uid = old_uid;
    new_gid = old_gid;
 
    if (valid & ATTR_MODE)
        new_mode = BPF_CORE_READ(attr, ia_mode) & 07777U;
    if (valid & ATTR_UID) {
        kuid_t uid = {};
        BPF_CORE_READ_INTO(&uid, attr, ia_uid);
        new_uid = uid.val;
    }
    if (valid & ATTR_GID) {
        kgid_t gid = {};
        BPF_CORE_READ_INTO(&gid, attr, ia_gid);
        new_gid = gid.val;
    }
 
    /*
     * Production filtering: ordinary chmod/chown traffic is not a security
     * incident and must not flood a desktop system.  Global events are emitted
     * only for privilege-relevant transitions.  Full metadata monitoring and
     * enforcement remain available for identities explicitly loaded into
     * protected_inodes.
     */
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (protected) {
        if ((valid & ATTR_MODE) &&
            (protected->flags & RG_PROTECT_MODE) &&
            new_mode != protected->baseline_mode)
            protected_reasons |= RG_REASON_PROTECTED_MODE;
        if (((valid & ATTR_UID) || (valid & ATTR_GID)) &&
            (protected->flags & RG_PROTECT_OWNER) &&
            (new_uid != protected->baseline_uid ||
             new_gid != protected->baseline_gid))
            protected_reasons |= RG_REASON_PROTECTED_OWNER;
    }
 
    cfg = kernel_config();
 
    /*
     * Do not feed the ring buffer with unprotected chmod/chown traffic below
     * /run. BastionGuard Backup mounts temporary backup filesystems there and
     * restoring file metadata would otherwise look like a stream of global
     * privilege changes. Explicit protected identities always take precedence.
     * Credential provenance was checked above and is not bypassed.
     */
    if (!protected && cfg && cfg->ignore_run_global_metadata &&
        pending_path_is_under_run(&key)) {
        discard_pending_path();
        return 0;
    }
 
    if (cfg && cfg->monitor_global_privilege_metadata) {
        /* A newly added setuid/setgid bit can create a direct privilege path. */
        if ((valid & ATTR_MODE) &&
            ((new_mode & (S_ISUID | S_ISGID)) &
             ~(old_mode & (S_ISUID | S_ISGID))))
            global_reasons |= RG_REASON_SETID_ADDED | RG_REASON_GLOBAL_METADATA;
 
        /* Changing a previously non-root object to UID 0 is security-relevant. */
        if ((valid & ATTR_UID) && old_uid != 0 && new_uid == 0)
            global_reasons |= RG_REASON_OWNER_TO_ROOT | RG_REASON_GLOBAL_METADATA;
 
        /*
         * Alert when an object that was already root-owned gains write access
         * for group or other users.
         */
        if ((valid & ATTR_MODE) && old_uid == 0 && new_uid == 0 &&
            ((new_mode & (S_IWGRP | S_IWOTH)) &
             ~(old_mode & (S_IWGRP | S_IWOTH))))
            global_reasons |= RG_REASON_ROOT_OWNED_WRITE_EXPOSURE |
                              RG_REASON_GLOBAL_METADATA;
    }
 
    if (!protected && cfg &&
        ((valid & ATTR_MODE) || (valid & ATTR_UID) || (valid & ATTR_GID))) {
        bool burst_candidate = false;
 
        /*
         * Backups and package managers legitimately replay huge numbers of
         * chmod/chown operations.  A ransomware-style lockout is materially
         * different: it removes the owner's ability to access the object, or
         * promotes ownership to root.  Count only those destructive patterns
         * for burst escalation; routine metadata replay does not consume the
         * burst budget.
         */
        if ((valid & ATTR_MODE) &&
            (old_mode & (S_IRUSR | S_IWUSR)) != 0 &&
            (new_mode & (S_IRUSR | S_IWUSR)) == 0)
            burst_candidate = true;
        if ((valid & ATTR_UID) && old_uid != 0 && new_uid == 0)
            burst_candidate = true;
 
        metadata_decision = observe_unprotected_metadata(
            burst_candidate, global_reasons != 0, &burst_count);
        if (metadata_decision & RG_METADATA_DECISION_BURST)
            reasons |= RG_REASON_METADATA_BURST | RG_REASON_GLOBAL_METADATA;
        if (global_reasons &&
            !(metadata_decision & RG_METADATA_DECISION_SAMPLE))
            global_reasons = 0;
    }
 
    reasons |= global_reasons | protected_reasons;
    if (!reasons)
        return 0;
 
    verdict = metadata_verdict(
        protected_reasons != 0,
        protected && (protected->flags & RG_PROTECT_AUDIT_ONLY),
        (reasons & RG_REASON_GLOBAL_METADATA) != 0);
    event_type = (((valid & ATTR_UID) && new_uid != old_uid) ||
                  ((valid & ATTR_GID) && new_gid != old_gid))
                     ? RG_EVENT_OWNER_CHANGE
                     : RG_EVENT_PERMISSION_CHANGE;
 
    {
        __u32 actor_euid = current_euid_value();
        emit_event(event_type, verdict, reasons,
                   protected ? protected->rule_id : 0,
                   actor_euid, actor_euid,
                   (int)valid, burst_count, &key, dentry_name_ptr(dentry), 0,
                   old_mode, new_mode, old_uid, new_uid, old_gid, new_gid);
    }
 
    return lsm_result_from_verdict(verdict);
}
 
static __always_inline int handle_xattr_change(struct dentry *dentry,
                                                const char *name,
                                                int operation_flags)
{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    const struct rg_kernel_config *cfg;
    struct inode *inode;
    __u32 current_mode = 0, current_uid = 0, current_gid = 0;
    __u32 reasons = 0, protected_reasons = 0, verdict, metadata_decision = 0;
    int kind;
 
    int guard = guard_current_root_provenance(0, operation_flags, 0);
    if (guard)
        return guard;
    if (!file_key_from_dentry(dentry, &key))
        return 0;
 
    inode = BPF_CORE_READ(dentry, d_inode);
    inode_metadata(inode, &current_mode, &current_uid, &current_gid);
 
    kind = xattr_kind(name);
    if (!kind)
        return 0;
 
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (protected) {
        if (kind == 1 &&
            (protected->flags & RG_PROTECT_CAPABILITY_XATTR))
            protected_reasons |= RG_REASON_SECURITY_CAPABILITY;
        else if (kind == 2 &&
                 (protected->flags & RG_PROTECT_INTEGRITY_XATTR))
            protected_reasons |= RG_REASON_INTEGRITY_XATTR;
        else if (kind == 3 &&
                 (protected->flags & RG_PROTECT_SECURITY_LABEL))
            protected_reasons |= RG_REASON_SECURITY_LABEL;
    }
 
    cfg = kernel_config();
    if (!protected && kind == 1 && operation_flags >= 0 && cfg &&
        cfg->monitor_global_privilege_metadata)
        metadata_decision = observe_unprotected_metadata(false, true, 0);
    if (kind == 1 && cfg && cfg->monitor_global_privilege_metadata &&
        (protected || (metadata_decision & RG_METADATA_DECISION_SAMPLE)))
        reasons |= RG_REASON_SECURITY_CAPABILITY | RG_REASON_GLOBAL_METADATA;
 
    reasons |= protected_reasons;
    if (!reasons)
        return 0;
 
    verdict = metadata_verdict(
        protected_reasons != 0,
        protected && (protected->flags & RG_PROTECT_AUDIT_ONLY),
        (reasons & RG_REASON_GLOBAL_METADATA) != 0);
    emit_event(RG_EVENT_XATTR_CHANGE, verdict, reasons,
               protected ? protected->rule_id : 0,
               0, 0, operation_flags, (__u32)kind,
               &key, dentry_name_ptr(dentry), name,
               current_mode, current_mode,
               current_uid, current_uid, current_gid, current_gid);
    return lsm_result_from_verdict(verdict);
}
 
SEC("lsm/inode_setxattr")
int BPF_PROG(rg_inode_setxattr, struct mnt_idmap *idmap,
             struct dentry *dentry, const char *name, const void *value,
             size_t size, int flags, int ret)
{
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    return handle_xattr_change(dentry, name, flags);
}
 
SEC("lsm/inode_removexattr")
int BPF_PROG(rg_inode_removexattr, struct mnt_idmap *idmap,
             struct dentry *dentry, const char *name, int ret)
{
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    return handle_xattr_change(dentry, name, -1);
}
 
SEC("lsm/inode_set_acl")
int BPF_PROG(rg_inode_set_acl, struct mnt_idmap *idmap,
             struct dentry *dentry, const char *acl_name,
             struct posix_acl *kacl, int ret)
{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    __u32 verdict;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    if (!file_key_from_dentry(dentry, &key))
        return 0;
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (protected && (protected->flags & RG_PROTECT_ACL)) {
        verdict = metadata_verdict(true,
            (protected->flags & RG_PROTECT_AUDIT_ONLY) != 0, false);
        emit_event(RG_EVENT_ACL_CHANGE, verdict, RG_REASON_PROTECTED_ACL,
                   protected->rule_id, 0, 0, 1, 0,
                   &key, dentry_name_ptr(dentry), acl_name,
                   0, 0, 0, 0, 0, 0);
    } else {
        /*
         * Do not emit every global ACL edit.  The hook does not provide a
         * low-noise semantic verdict here, so unprotected ACL activity remains
         * silent instead of generating production false positives.
         */
        return 0;
    }
    return lsm_result_from_verdict(verdict);
}
 
SEC("lsm/inode_remove_acl")
int BPF_PROG(rg_inode_remove_acl, struct mnt_idmap *idmap,
             struct dentry *dentry, const char *acl_name, int ret)
{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    __u32 verdict;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    if (!file_key_from_dentry(dentry, &key))
        return 0;
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (protected && (protected->flags & RG_PROTECT_ACL)) {
        verdict = metadata_verdict(true,
            (protected->flags & RG_PROTECT_AUDIT_ONLY) != 0, false);
        emit_event(RG_EVENT_ACL_CHANGE, verdict, RG_REASON_PROTECTED_ACL,
                   protected->rule_id, 0, 0, -1, 0,
                   &key, dentry_name_ptr(dentry), acl_name,
                   0, 0, 0, 0, 0, 0);
    } else {
        /* Unprotected ACL removals are intentionally silent for the same reason. */
        return 0;
    }
    return lsm_result_from_verdict(verdict);
}
 
SEC("lsm/inode_unlink")
int BPF_PROG(rg_inode_unlink, struct inode *dir,
             struct dentry *dentry, int ret)
{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    __u32 verdict;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    if (!file_key_from_dentry(dentry, &key))
        return 0;
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (!protected || !(protected->flags & RG_PROTECT_UNLINK))
        return 0;
 
    verdict = metadata_verdict(true,
            (protected->flags & RG_PROTECT_AUDIT_ONLY) != 0, false);
    emit_event(RG_EVENT_PROTECTED_UNLINK, verdict,
               RG_REASON_PROTECTED_UNLINK, protected->rule_id,
               0, 0, 0, 0, &key, dentry_name_ptr(dentry), 0,
               0, 0, 0, 0, 0, 0);
    return lsm_result_from_verdict(verdict);
}
 
SEC("lsm/inode_rename")
int BPF_PROG(rg_inode_rename, struct inode *old_dir,
             struct dentry *old_dentry, struct inode *new_dir,
             struct dentry *new_dentry, int ret)
{
    struct rg_file_key key = {};
    struct rg_protected_value *protected = 0;
    __u32 verdict;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
 
    if (file_key_from_dentry(old_dentry, &key))
        protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (!protected && file_key_from_dentry(new_dentry, &key))
        protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (!protected || !(protected->flags & RG_PROTECT_RENAME))
        return 0;
 
    verdict = metadata_verdict(true,
            (protected->flags & RG_PROTECT_AUDIT_ONLY) != 0, false);
    emit_event(RG_EVENT_PROTECTED_RENAME, verdict,
               RG_REASON_PROTECTED_RENAME, protected->rule_id,
               0, 0, 0, 0, &key, dentry_name_ptr(old_dentry), 0,
               0, 0, 0, 0, 0, 0);
    return lsm_result_from_verdict(verdict);
}
 
SEC("tp/sched/sched_process_exit")
int rg_sched_process_exit(struct trace_event_raw_sched_process_template *ctx)
{
    __u64 ids = bpf_get_current_pid_tgid();
    __u32 pid = (__u32)ids;
    __u32 tgid = (__u32)(ids >> 32);
 
    if (pid == tgid)
        bpf_map_delete_elem(&exec_contexts, &tgid);
    bpf_map_delete_elem(&pending_paths, &ids);
    return 0;
}
 
SEC("lsm/inode_link")
int BPF_PROG(rg_inode_link, struct dentry *old_dentry,
             struct inode *dir, struct dentry *new_dentry, int ret)
{
    struct rg_file_key key = {};
    struct rg_protected_value *protected;
    __u32 verdict;
 
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    ret = guard_current_root_provenance(0, 0, 0);
    /* Preserve an earlier LSM denial with a verifier-safe errno. */
    if (ret)
        return -EPERM;
    if (!file_key_from_dentry(old_dentry, &key))
        return 0;
    protected = bpf_map_lookup_elem(&protected_inodes, &key);
    if (!protected || !(protected->flags & RG_PROTECT_HARDLINK))
        return 0;
 
    verdict = metadata_verdict(true,
            (protected->flags & RG_PROTECT_AUDIT_ONLY) != 0, false);
    emit_event(RG_EVENT_PROTECTED_HARDLINK, verdict,
               RG_REASON_PROTECTED_HARDLINK, protected->rule_id,
               0, 0, 0, 0, &key, dentry_name_ptr(old_dentry), 0,
               0, 0, 0, 0, 0, 0);
    return lsm_result_from_verdict(verdict);
}