[AlonLiwsky]

Overview

This reports the privilege, network and file verdicts (enforced denies and audit wouldDeny) to the same receivers that exec authorizations use, so a private exporter (for example the OTLP mapping in armosec/private-node-agent#747) can pick them up. Until now these verdicts only went to the node-agent log.

It is stacked on #1075 (file gadget, which contains #1073, #1068 and #1067). GitHub can't use a fork branch as the base, so please review only the commits that are not in #1075, and merge after it.

Draft on purpose: the OTLP side lives in the private fork, and I'd like to align with @matthyx on whether this belongs here or folded into his exporter work.

What changes

• Typed section events (pkg/sandboxpolicy/section_verdict.go): one event per verdict for privilege, network and file, with its own dispatch key, the policy identity (kind, name, uid, generation, namespace) and revision, rule name, origins list, mode, wouldDeny, the target in policy words (for example read, not the C enum name) and the actor (process, container, pod).
• Binding lookup: the event's cgroup is resolved to its container or pod binding, and the policy set comes from the judging instance's slot table (by generation and slot).
• Own queue: section events have their own queue and worker and feed the same receivers. The exec exporter is unchanged (exporter.go is identical to feat(sandboxpolicy): enforce the SandboxPolicy file section with a BPF LSM gadget #1075), so a burst of section denies can never drop or delay an exec verdict. A test sends 1,000 section denies into a 4-entry section queue: 996 section events are dropped and counted, 0 exec verdicts.
• Counters: kernel ring-buffer drops and section queue drops are exposed through Service.SectionVerdictStats() / SectionExporterStats(). A drop is never silent.
• Debug receiver behind sandboxPolicyDebugExport (default off): logs one line per exported event, for local testing.
• One verdict is one kernel check, not one syscall (an audited setns on a mount namespace gives two). The exporter does not dedupe; the doc says so.

Production code is about 950 lines (the section exporter ~150, the debug receiver ~70, the subscriber rewrite), tests about 820, docs about 35.

How to test

• go test ./pkg/sandboxpolicy/...
• Kernel export test on 6.8 and 6.17 (arm64): one enforced deny and one audit wouldDeny per section reach a test receiver with binding, policy identity, rule, origins, target and counters.
• Local kind end-to-end run with the debug receiver on: every one of the 175 denied or audited actions produced its event with the right wouldDeny, rule and pod binding; for a pod with two policies, the event names the deciding policy and both in the set.

Open questions

1. Does this stay here, or fold into the exporter work in the private fork (Test/improvecomponenttest #747)?
2. The backend accepts only exec verdicts today. Privilege, network and file need backend changes (rule family per section with an authorization phase, a phase guard on the R-NET-1 / R-FILE-1 observation views, section defaults, target keys). I'm aligning that separately.

Tracking: SUB-9591.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

[matthyx]

I prefer this typed public section-verdict/independent-queue work to stay in node-agent #1080. The private OTLP mapping belongs in armosec/private-node-agent#747; folding public event dispatch into the private fork would blur that boundary. Please keep the authorization-vs-observation distinction and explicit loss counters; I agree that one event per kernel check is not one event per syscall.

One schema detail to fix before the exporter consumes it: NewSectionVerdict currently appends an origin only when origin != "", while verdictFields.read returns the same empty string for absent ID 0 and a present explicitly empty label. The merged design and exec path preserve explicit origin: [""] separately from omitted origin: []. Please carry origin presence/ID separately through this decoder and test both cases (including defaults), rather than inferring presence from the string. The private family/phase mapping and backend ingestion contract can be agreed in a subsequent stacked change; this draft need not implement them itself.