AegisBPF – eBPF runtime security and policy enforcement agent

AegisBPF is a Linux runtime security agent that uses extended Berkeley Packet Filter (eBPF) and Linux Security Module (LSM) hooks to enforce access-control policies. It is designed to prevent unauthorised file and network operations rather than simply reporting suspicious activity after it occurs.

The software separates policy management and event processing in userspace from enforcement logic running inside the kernel. It targets individual Linux hosts and Kubernetes workloads, allowing administrators to apply security restrictions to specific processes and applications.

AegisBPF provides facilities for auditing system activity, investigating security events and managing enforcement policies. Its effectiveness depends on the host’s kernel configuration and available security capabilities.

This is free and open source software.

Key Features

• Kernel-level enforcement – uses BPF LSM hooks to deny selected file and network operations before they complete.
• File protection – supports path-based and device/inode-based rules, including handling of OverlayFS copy-up operations.
• Network restrictions – blocks connections using IPv4 and IPv6 addresses, CIDR ranges, ports and endpoint combinations.
• Socket monitoring – covers connect, bind, listen, accept, send and receive operations where supported by the kernel.
• Cgroup policies – applies restrictions to individual workloads while allowing trusted processes to be exempted.
• Audit-only mode – monitors activity without blocking operations when enforcement is unavailable or disabled.
• Policy management – supports declarative configuration, SHA-256 verification, signed policy bundles and rollback.
• Executable verification – integrates with Linux Integrity Measurement Architecture (IMA) to check executable identity.
• Forensic information – records process identifiers, user and group details, execution identity and process ancestry.
• Structured logging – generates JSON or text output suitable for integration with logging and security monitoring systems.
• Prometheus integration – exports security event statistics, enforcement counters and operational metrics.
• Kubernetes support – provides Helm deployment, admission policy validation and an operator web console.
• Health monitoring – reports available kernel security capabilities, BPF map usage and enforcement status.
• Emergency controls – includes an auditable mechanism for temporarily bypassing enforcement.
• Extensibility – supports custom event handlers and dynamically loaded detection rules.

Website: github.com/ErenAri/Aegis-BPF
Support:
Developer: Eren Arı
License: Apache License 2.0

AegisBPF is written in C and C++. Learn C with our recommended free books and free tutorials. Learn C++ with our recommended free books and free tutorials.

This software was suggested by the developer who completed this form. Help the site by suggesting new open source software.

Explore our carefully curated directory of recommended free and open source software, covering every major software category. The directory forms part of our extensive collection of articles for Linux enthusiasts. It includes hundreds of detailed reviews, together with free and open source alternatives to proprietary software from companies such as Google, Microsoft, Apple, Adobe, IBM, Cisco, Oracle, and Autodesk. LinuxLinks also covers interesting projects worth exploring, Linux-compatible hardware, free programming books and tutorials, and much more. Know a useful free and open source Linux application that we haven’t covered? Tell us about it using our submission form.