feat(linux): Initial Linux support

.github/workflows/linux-port.yml

@@ -0,0 +1,72 @@
+name: linux-port
+
+on:
+  pull_request:
+    branches:
+      - linux-port
+  workflow_dispatch:
+
+concurrency:
+  group: linux-port-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
+env:
+  GO_VERSION: 1.26.x
+  GOLANGCI_LINT_VERSION: v2.9.0
+  CLANG_VERSION: 18
+
+jobs:
+  ebpf:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR title
+        if: github.event_name == 'pull_request'
+        uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Checkout
+        uses: actions/checkout@v4
+      - name: Install Go
+        uses: actions/setup-go@v5
+        with:
+          go-version: ${{ env.GO_VERSION }}
+      # Deliberately before clang is installed: a checkout must build from the
+      # committed objects alone.
+      - name: Build without generation tools
+        run: make
+      - name: Install clang
+        run: |
+          sudo apt-get update
+          sudo apt-get install -y clang-${{ env.CLANG_VERSION }} llvm-${{ env.CLANG_VERSION }}
+          clang-${{ env.CLANG_VERSION }} --version
+      # The versioned packages ship no unversioned symlinks, so name both tools.
+      - name: Check generation drift
+        run: make ebpf-drift CLANG=clang-${{ env.CLANG_VERSION }} LLVM_STRIP=llvm-strip-${{ env.CLANG_VERSION }}
+      - name: Install golangci-lint
+        run: |
+          curl -sSfL https://raw.githubusercontent.com/golangci/golangci-lint/master/install.sh | sh -s -- -b $(go env GOPATH)/bin ${{ env.GOLANGCI_LINT_VERSION }}
+      - name: Lint
+        run: |
+          export PATH=$(go env GOPATH)/bin:$PATH
+          make lint
+      - name: Unit tests
+        run: make test
+      - name: Race tests
+        run: make test-race
+      - name: Validate rules
+        run: |
+          ./cmd/fibratus/fibratus rules validate \
+            --filters.rules.from-paths="rules/linux/*.yml" \
+            --filters.macros.from-paths="rules/linux/macros/*.yml"
+      # Fails, rather than skips, when the runner cannot host the backend, so a
+      # green integration run always means programs actually loaded.
+      - name: Probe eBPF prerequisites
+        run: sudo -E env "PATH=$PATH" go test -tags ebpf_integration -count=1 -run TestPrerequisitesAreMet -v ./internal/ebpf
+      - name: Privileged process source
+        run: sudo -E env "PATH=$PATH" make test-integration
+      - name: Package
+        run: make pkg
+      - uses: actions/upload-artifact@v4
+        with:
+          name: fibratus-linux-packages
+          path: build/pkg/*

.gitignore

@@ -1,15 +1,25 @@
+# Binaries
 cmd/fibratus/fibratus.exe
 cmd/fibratus/fibratus.syso
-
+cmd/fibratus/fibratus
 cmd/systray/fibratus-systray.exe
 cmd/systray/fibratus-systray.syso
 
+# Resource message table
 pkg/util/eventlog/mc/*
 !pkg/util/eventlog/mc/gen.go
 
+# Windows MSI package
 build/msi/fibratus-*
 build/msi/*.wixpdb
 build/msi/*.msi
 
+# IDE
 .idea
+.vscode
+
+# Python bytecode cache
 filaments/__pycache__
+
+# Linux packages
+build/pkg/

.golangci.yml

@@ -1,8 +1,8 @@
 version: "2"
-run:
-  build-tags:
-    - cap
-    - filament
+# run:
+#   build-tags:
+#     - cap
+#     - filament
 
 linters:
   default: none
@@ -43,7 +43,7 @@ linters:
         path: pkg/util/ports/iana_ports.go
       - linters:
           - goconst
-        path: pkg/event/flags.go
+        path: pkg/event/flags_windows.go
       - linters:
           - goconst
         path: pkg/filter/ql/functions/(.+)\.go
@@ -56,6 +56,9 @@ linters:
       - linters:
           - goconst
         path: pkg/filter/fields/fields_windows.go
+      - linters:
+          - goconst
+        path: pkg/filter/fields/defs_windows.go
       - linters:
           - goconst
         path: cmd/fibratus/app/list/list.go

Makefile

@@ -0,0 +1,155 @@
+.DEFAULT_GOAL := build
+
+SHELL := /bin/bash
+.SHELLFLAGS := -euo pipefail -c
+
+BPF2GO_VERSION := v0.20.0
+GOLANGCI_LINT_VERSION := v2.9.0
+NFPM_VERSION := v2.43.0
+
+# The committed objects are byte-compared in CI, and clang encodes its version
+# into BTF, so generating with a different major produces a spurious diff.
+CLANG_VERSION := 18
+
+# The generated objects target x86-64 and the runtime refuses other
+# architectures, so building the binary pins the same one.
+TARGET_ARCH ?= amd64
+
+# Specifies a list of build flags
+TAGS ?=
+
+BPF_DIR := internal/ebpf
+BPF_OUT := $(BPF_DIR)/bpf
+
+CLANG ?= clang
+LLVM_STRIP ?= llvm-strip
+GO ?= go
+GOFMT ?= gofmt
+BPF2GO ?= go run github.com/cilium/ebpf/cmd/bpf2go@$(BPF2GO_VERSION)
+
+BPF_FLAGS := \
+	-go-package bpf \
+	-output-dir $(BPF_OUT) \
+	-cc $(CLANG) \
+	-strip $(LLVM_STRIP) \
+	-target bpfel,bpfeb \
+	-tags linux
+
+# Production headers first; spike/c is only the vmlinux.h fallback.
+BPF_CFLAGS := \
+	-I./$(BPF_DIR)/c \
+	-I./$(BPF_DIR)/c/common \
+	-I./$(BPF_DIR)/spike/c \
+	-O2 \
+	-g \
+	-D__TARGET_ARCH_x86
+
+# Find all eBPF sources.
+BPF_SOURCES := $(wildcard $(BPF_DIR)/c/*.bpf.c)
+BPF_NAMES := $(patsubst $(BPF_DIR)/c/%.bpf.c,%,$(BPF_SOURCES))
+BPF_TARGETS := $(foreach name,$(BPF_NAMES), \
+	$(BPF_OUT)/$(name)_bpfel.go \
+	$(BPF_OUT)/$(name)_bpfeb.go)
+
+titlecase = $(shell printf '%s' '$(1)' | awk '{print toupper(substr($$0,1,1)) substr($$0,2)}')
+
+.PHONY: ebpf
+ebpf: check-clang $(BPF_TARGETS)
+$(BPF_OUT)/%_bpfel.go $(BPF_OUT)/%_bpfeb.go &: $(BPF_DIR)/c/%.bpf.c
+	$(BPF2GO) $(BPF_FLAGS) -output-stem $* $(call titlecase,$*) $(BPF_DIR)/c/$*.bpf.c -- $(BPF_CFLAGS)
+
+.PHONY: check-clang
+check-clang:
+	@command -v $(CLANG) >/dev/null 2>&1 || { \
+		echo "$(CLANG) not found. Generating the eBPF objects needs clang $(CLANG_VERSION)."; \
+		exit 1; \
+	}
+	@command -v $(LLVM_STRIP) >/dev/null 2>&1 || { \
+		echo "$(LLVM_STRIP) not found. Versioned llvm packages ship llvm-strip-$(CLANG_VERSION)"; \
+		echo "without the unversioned name bpf2go looks for."; \
+		echo "Point LLVM_STRIP at it, e.g. make ebpf LLVM_STRIP=llvm-strip-$(CLANG_VERSION)."; \
+		exit 1; \
+	}
+	@have=$$($(CLANG) --version | sed -n 's/.*clang version \([0-9]*\).*/\1/p' | head -1); \
+	if [ "$$have" != "$(CLANG_VERSION)" ]; then \
+		echo "clang $$have found but the committed objects were generated with $(CLANG_VERSION)."; \
+		echo "Regenerating with another major rewrites every object and fails ebpf-drift."; \
+		echo "Point CLANG at the right binary, e.g. make ebpf CLANG=clang-$(CLANG_VERSION)."; \
+		exit 1; \
+	fi
+
+# Regenerating must be reproducible: same sources and same clang, same bytes.
+.PHONY: ebpf-drift
+ebpf-drift:
+	$(MAKE) -B ebpf
+	git diff --exit-code -- $(BPF_OUT)
+
+ifeq ($(strip $(TAGS)),)
+BUILD_TAGS :=
+else
+BUILD_TAGS := -tags $(TAGS)
+endif
+
+# Builds from the committed objects alone, so a fresh checkout needs no clang
+# and no kernel headers. Naming the target pair keeps this buildable from a
+# developer machine that is neither, which is the cheapest way to prove it.
+.PHONY: build
+build:
+	GOOS=linux GOARCH=$(TARGET_ARCH) $(GO) build $(BUILD_TAGS) -o ./cmd/fibratus/fibratus ./cmd/fibratus/
+
+.PHONY: fmt
+fmt:
+	$(GOFMT) -e -s -l -w pkg cmd internal
+
+TEST_PKGS := \
+	./internal/ebpf \
+	./internal/bootstrap \
+	./pkg/api \
+	./pkg/config \
+	./pkg/event \
+	./pkg/filter \
+	./pkg/ps \
+	./pkg/rules \
+	./pkg/rules/action \
+	./pkg/util/signals
+
+.PHONY: test
+test:
+	$(GO) test $(TEST_PKGS)
+
+.PHONY: test-race
+test-race:
+	$(GO) test -race $(TEST_PKGS)
+
+# Needs a 5.9+ kernel with runtime BTF, and root to load and attach.
+.PHONY: test-integration
+test-integration:
+	$(GO) test -tags ebpf_integration -count=1 ./internal/ebpf
+
+# Narrower than TEST_PKGS on purpose. Packages outside this set carry helpers
+# that only Windows reaches, so `unused` reports them on every Linux run and
+# there is nothing to fix without moving Windows code around.
+LINT_PKGS := \
+	./internal/ebpf/... \
+	./internal/bootstrap/... \
+	./pkg/filter/... \
+	./pkg/rules/...
+
+.PHONY: lint
+lint:
+	golangci-lint run $(LINT_PKGS)
+
+VERSION ?= 0.0.0
+PKG_DIR := build/pkg
+NFPM ?= go run github.com/goreleaser/nfpm/v2/cmd/nfpm@$(NFPM_VERSION)
+
+.PHONY: pkg
+pkg: build
+	@mkdir -p $(PKG_DIR)
+	VERSION=$(VERSION) $(NFPM) package --config build/linux/nfpm.yaml --packager deb --target $(PKG_DIR)
+	VERSION=$(VERSION) $(NFPM) package --config build/linux/nfpm.yaml --packager rpm --target $(PKG_DIR)
+
+.PHONY: clean
+clean:
+	rm -f cmd/fibratus/fibratus
+	rm -rf $(PKG_DIR)

build/linux/fibratus.service

@@ -0,0 +1,44 @@
+[Unit]
+Description=Fibratus
+Documentation=https://www.fibratus.io
+After=network.target
+
+[Service]
+Type=simple
+ExecStart=/usr/bin/fibratus run
+Restart=on-failure
+RestartSec=5s
+
+# Fibratus starts as root because attaching a syscall tracepoint reads its id
+# from /sys/kernel/tracing, which is root-only on stock distributions. The
+# bounding set is what actually constrains it: everything below is dropped, so
+# the process keeps only what the backend and the kill action need.
+#
+#   CAP_BPF         load programs, create and update maps
+#   CAP_PERFMON     attach to tracepoints
+#   CAP_SYS_PTRACE  read /proc/<pid>/exe and cmdline of other users' processes
+#   CAP_KILL        signal a target, needed only by the kill rule action
+#
+# CAP_BPF and CAP_PERFMON were split out of CAP_SYS_ADMIN in 5.8. On a kernel
+# that predates the split, replace both with CAP_SYS_ADMIN.
+CapabilityBoundingSet=CAP_BPF CAP_PERFMON CAP_SYS_PTRACE CAP_KILL
+AmbientCapabilities=CAP_BPF CAP_PERFMON CAP_SYS_PTRACE CAP_KILL
+NoNewPrivileges=yes
+
+# full rather than strict: strict would also mount /run read-only and the API
+# socket lives there.
+ProtectSystem=full
+ProtectHome=yes
+PrivateTmp=yes
+ProtectKernelTunables=yes
+ProtectKernelModules=yes
+ProtectControlGroups=yes
+RestrictSUIDSGID=yes
+LockPersonality=yes
+
+# Process enrichment reads other processes' procfs entries, so this must stay
+# permissive. Hiding them would silently empty ps.exe and ps.cmdline.
+ProtectProc=default
+
+[Install]
+WantedBy=multi-user.target

build/linux/nfpm.yaml

@@ -0,0 +1,46 @@
+name: fibratus
+arch: amd64
+platform: linux
+version: ${VERSION}
+section: admin
+priority: optional
+maintainer: Nedim Sabic Sabic <https://fibratus.io>
+description: |
+  Security sensor for realtime threat detection and protection
+vendor: Fibratus
+homepage: https://fibratus.io
+license: Apache-2.0
+
+# The BPF objects are embedded in the binary at compile time, so there is
+# nothing to ship alongside it.
+contents:
+  - src: ./cmd/fibratus/fibratus
+    dst: /usr/bin/fibratus
+
+  - src: ./configs/fibratus-linux.yml
+    dst: /etc/fibratus/fibratus.yml
+    type: config|noreplace
+
+  - src: ./rules/linux/*.yml
+    dst: /etc/fibratus/rules/
+
+  - src: ./rules/linux/macros/macros.yml
+    dst: /etc/fibratus/rules/macros/macros.yml
+
+  - src: ./build/linux/fibratus.service
+    dst: /lib/systemd/system/fibratus.service
+
+overrides:
+  rpm:
+    contents:
+      - src: ./cmd/fibratus/fibratus
+        dst: /usr/bin/fibratus
+      - src: ./configs/fibratus-linux.yml
+        dst: /etc/fibratus/fibratus.yml
+        type: config|noreplace
+      - src: ./rules/linux/*.yml
+        dst: /etc/fibratus/rules/
+      - src: ./rules/linux/macros/macros.yml
+        dst: /etc/fibratus/rules/macros/macros.yml
+      - src: ./build/linux/fibratus.service
+        dst: /usr/lib/systemd/system/fibratus.service