RootGuard 2.5.0 changes the shared BPF/userspace event ABI. Rebuild and install the daemon, generated BPF object, action helper and GTK page together. Do not mix 2.4 binaries with the 2.5 BPF object.

From the BastionGuard source root:

sudo cp -a /etc/bastionguard/rootguard.conf \
  /var/tmp/rootguard.conf.before-2.5.0
 
cmake -S . -B build
cmake --build build --target bastionguard-rootguard \
  bastionguard-rootguard-action BastionGuard -j"$(nproc)"
sudo cmake --install build

The installer preserves an existing rootguard.conf. The new packaged reference is available at:

/etc/bastionguard/rootguard.conf.default

Restart the service using the active init system. For systemd:

sudo systemctl reset-failed bastionguard-rootguard.service
sudo systemctl restart bastionguard-rootguard.service
sudo systemctl status bastionguard-rootguard.service --no-pager

Open RootGuardPage, select Application rules, use Add installed desktop/browser defaults, review the detected paths, then select Save rules and restart RootGuard.

The UI save operation adds [trusted-applications], [trusted-executables] and [denied-executables] as needed. Existing policy sections outside those three are preserved.