stella-ops.org/git.stella-ops.org
1
0
Fork 0
Code Issues Pull Requests Actions 2 Releases Wiki Activity

save checkpoint

Browse Source
This commit is contained in:
master
2026-02-14 09:11:48 +02:00
parent 9ca2de05df
commit e9aeadc040
1512 changed files with 30863 additions and 4728 deletions
Download Patch File Download Diff File Expand all files Collapse all files

43
docs/features/checked/scanner/ebpf-capture-abstraction.md Normal file
View File

@@ -0,0 +1,43 @@
# eBPF Capture Abstraction
## Module
Scanner
## Status
VERIFIED
## Description
Platform-level eBPF capture adapter for Linux with runtime evidence aggregation, plus dedicated eBPF library at `src/Signals/__Libraries/StellaOps.Signals.Ebpf/` with probe loaders, parsers, and air-gap support.
## Implementation Details
- **Runtime Capture Adapters** (platform-specific):
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/IRuntimeCaptureAdapter.cs` - Interface for platform-specific runtime capture
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/LinuxEbpfCaptureAdapter.cs` - Linux eBPF capture adapter
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/MacOsDyldCaptureAdapter.cs` - macOS dyld capture adapter
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/WindowsEtwCaptureAdapter.cs` - Windows ETW capture adapter
- **Runtime Evidence**:
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/RuntimeEvidence.cs` - Runtime evidence model
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/RuntimeEvidenceAggregator.cs` - Aggregates runtime evidence from capture adapters
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/StackTraceCapture.cs` - Stack trace capture model
- **Capture Configuration**:
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/RuntimeCaptureOptions.cs` - Capture options
- `src/Scanner/StellaOps.Scanner.Analyzers.Native/RuntimeCapture/CaptureDurationTimer.cs` - Duration timer for capture sessions
## E2E Test Plan
- [ ] Configure eBPF capture on a Linux host and verify `LinuxEbpfCaptureAdapter` collects runtime library loading events
- [ ] Verify `RuntimeEvidenceAggregator` aggregates captured events into structured runtime evidence
- [ ] Verify stack trace capture captures function call chains from eBPF probes
- [ ] Verify capture duration timer correctly limits capture sessions
- [ ] Verify the capture adapter interface allows switching between eBPF (Linux), ETW (Windows), and dyld (macOS)
- [ ] Verify runtime evidence can be used to confirm/deny static reachability claims
---
## Verification
| Check | Result |
|-------|--------|
| Tier 0 - Source files exist | PASS |
| Tier 1 - Build + code review | PASS |
| Tier 2 - Integration tests | PASS |
| Verified | 2026-02-13T18:10:00Z |