Skip to content

in_aegisbpf: add AegisBPF runtime-security input plugin #12272

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
ErenAri wants to merge 3 commits into
base: master
Choose a base branch
from
Open

in_aegisbpf: add AegisBPF runtime-security input plugin #12272

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
1f2f05d
in_aegisbpf: add AegisBPF runtime-security input plugin
ErenAri Aug 12, 2026
152ccc2
in_aegisbpf: gate to Linux, validate single JSON object, bound drain …
ErenAri Aug 12, 2026
abfa952
in_aegisbpf: declare variables at the top of functions
ErenAri Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions cmake/plugins_options.cmake
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -11,6 +11,7 @@ option(FLB_MINIMAL "Enable minimal build configuration" No)

# Inputs (sources, data collectors)
# =================================
DEFINE_OPTION(FLB_IN_AEGISBPF "Enable AegisBPF input plugin" ON)

@coderabbitai coderabbitai Bot Aug 12, 2026

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🩺 Stability & Availability | 🟠 Major | ⚡ Quick win

The POSIX-only plugin is enabled and registered without a platform guard. plugins/in_aegisbpf/in_aegisbpf.c includes <sys/un.h>, <sys/socket.h>, and <unistd.h>, and it calls fcntl and recv. Neither the build option nor the registration excludes Windows, so a Windows build attempts to compile the plugin and fails.

  • cmake/plugins_options.cmake#L14-L14: default FLB_IN_AEGISBPF to OFF on Windows instead of ON for all platforms.
  • plugins/CMakeLists.txt#L248-L248: wrap REGISTER_IN_PLUGIN("in_aegisbpf") in a platform condition that excludes Windows, matching how the repository gates other Unix-only inputs.
📍 Affects 2 files
  • cmake/plugins_options.cmake#L14-L14 (this comment)
  • plugins/CMakeLists.txt#L248-L248
🤖 Prompt for AI Agents 
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@cmake/plugins_options.cmake` at line 14, Default FLB_IN_AEGISBPF to OFF on
Windows while preserving ON for other platforms in
cmake/plugins_options.cmake:14-14. In plugins/CMakeLists.txt:248-248, wrap
REGISTER_IN_PLUGIN("in_aegisbpf") in a platform condition excluding Windows,
matching existing Unix-only plugin guards.

DEFINE_OPTION(FLB_IN_BLOB "Enable Blob input plugin" ON)
DEFINE_OPTION(FLB_IN_CALYPTIA_FLEET "Enable Calyptia Fleet input plugin" ON)
DEFINE_OPTION(FLB_IN_COLLECTD "Enable Collectd input plugin" ON)
Expand Down
1 change: 1 addition & 0 deletions plugins/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -245,6 +245,7 @@ endmacro()
# Custom Plugins
REGISTER_CUSTOM_PLUGIN("custom_calyptia")

REGISTER_IN_PLUGIN("in_aegisbpf")
Comment thread
cosmo0920 marked this conversation as resolved.
Outdated
REGISTER_IN_PLUGIN("in_blob")

# These plugins works only on Linux
Expand Down
4 changes: 4 additions & 0 deletions plugins/in_aegisbpf/CMakeLists.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,4 @@
set(src
in_aegisbpf.c)

FLB_PLUGIN(in_aegisbpf "${src}" "")
Loading
Loading