ErenAri/Aegis-BPF

v0.9.0 Security

This release includes 1 security fix for security teams reviewing exposed deployments.

Published 23d Network Security

View tool

✓ No known CVEs patched

Read the diff → Tool health → What is this tool? →

This release patches 1 known CVE

Topics

bpf bpf-lsm cloud-native-security container-security ebpf helm

+9 more

incident-response kubernetes-security linux-kernel linux-security observability policy-enforcement prometheus runtime-security workload-securi

Affected surfaces

auth rbac deps

Summary

AI summary

Updates Added — Trust evidence, Fixed — Cross-kernel enforcement, and Changed — Docs across a mixed release.

Full changelog

Cross-kernel enforcement hardening, on-hardware trust evidence, and supply-chain CI hygiene — 146 commits since v0.8.0.

Fixed — Cross-kernel enforcement

Starts and enforces on kernels < 6.1 (#265) — the verifier-gated handle_exit tracepoint was aborting all enforcement on 5.4/5.10/5.15; the attach now honors the autoload gate.
Resilient BPF object load (#266) — a single verifier-fragile optional hook can no longer take down core enforcement.
handle_inode_copy_up verifies on all kernels (#267) — fixed a non-monotonic 6.8 verifier rejection via the barrier_var() + clamp idiom, restoring overlay copy-up enforcement with zero degradation.
Net: clean load + enforcement across the 5.15 → 6.17 LTS range.

Added — Trust evidence (reproducible, on-hardware)

Free cross-kernel enforcement matrix (5.15/6.1/6.8/6.17 via qemu/KVM) (#265).
Red-team alternate-read-path battery — io_uring / open_by_handle_at / openat2 (#263).
Backpressure-saturation battery — enforcement holds when telemetry drops (#264).
Enforcement-grade canary + red-team soak evidence (#241, #242).
Pilot evidence contract + validation test (#252).

Added — Security posture & CI supply-chain hardening

Least-privilege GITHUB_TOKEN across all workflows (#268) — cleared all OSSF Scorecard Token-Permissions alerts.
Future-LSM / next-gen BPF posture (#245); trusted-key-lookup hardening (#243); default-off policy authoritative mode (#240).
KPI-threshold, degraded-mode, rollback-failure, and e2e-matrix coverage contracts.
~20 pinned GitHub Action dependency bumps.

Changed — Docs

Categorized documentation index (docs/README.md) + docs-tree consolidation (#271).

Note on artifacts: this release was published directly from the tag. The signed release pipeline (release.yml) — Sigstore signatures, SBOM, build-provenance attestations, .deb/.rpm, and the GHCR image — runs on self-hosted bpf-lsm/perf runners, which were offline at tag time. Re-run the Release workflow for v0.9.0 once those runners are online to attach signed artifacts.

Full changelog: https://github.com/ErenAri/Aegis-BPF/compare/v0.8.0...v0.9.0

Security Fixes

Cross‑kernel enforcement fixed: verifier‑gated `handle_exit` no longer aborts all enforcement on kernels <6.1; resilient BPF object load prevents optional hooks from crashing core enforcement; `handle_inode_copy_up` verification restored across the 5.15 → 6.17 LTS range.

View diff on GitHub

Weekly OSS security release digest.

The CVE patches and breaking changes that affected production tools this week. One email, every Sunday.

No spam, unsubscribe anytime.

Share this release

Share on X Share on Bluesky

Track ErenAri/Aegis-BPF

Get notified when new releases ship.

About ErenAri/Aegis-BPF

All releases →