File ACTivity is a file integrity monitoring tool designed to help with PCI DSS compliance, which requires a change detection mechanism. It's implemented as a BPF agent, which coordinates a set of BPF programs attached to LSM hooks, receives events from the kernel, does basic enrichment and pushes them for further processing.

1. stable rust toolchains.
2. clang and libbpf headers for the C eBPF probe.
3. protoc and the Google protobuf definitions for gRPC.

On Fedora, you can install all the dependencies with the following commands:

sudo dnf install -y \
    clang \
    libbpf-devel \
    protobuf-compiler \
    protobuf-devel \
    rustup
rustup toolchain install stable

Use cargo build, cargo check, etc. as normal. Run your program with:

cargo run --release --config 'target."cfg(all())".runner="sudo -E"'

Cargo build scripts are used to automatically build the eBPF correctly and include it in the program.

For more details about available options, check out the references page.

There is some specific unit tests that execute just the eBPF code and the worker retrieving events from them. In order to run these, root privileges are required, so a feature is used to exclude them when running cargo test.

In order to run these tests as part of the unit test suite y use the following command:

cargo test --config 'target."cfg(all())".runner="sudo -E"' --features=bpf-test

compile_commands.json is a compilation database that can be used by clangd to provide better IDE support. This file is particularly useful for working with the C BPF code in the repository. In order to generate this file, bear is recommended, the following command can be used on x86 machines:

bear -- clang -target bpf -O2 -g -c -Wall -Werror -D__TARGET_ARCH_x86_64 fact-ebpf/src/bpf/main.c -o /dev/null

For arm64, replace -D__TARGET_ARCH_x86_64 with -D__TARGET_ARCH_aarch64.

With the exception of eBPF code, fact is distributed under the terms of the Apache License (version 2.0).

All eBPF code is distributed under either the terms of the GNU General Public License, Version 2 or the MIT license, at your option.

Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in this project by you, as defined in the GPL-2 license, shall be dual licensed as above, without any additional terms or conditions.