FAQ

FAQ

Does Aegis block anything?

Only if you ask it to. It starts in audit mode, which changes nothing on the host: its verdicts, would_throttle and would_quarantine, say what it would have done. Set mode = "enforce" and it does it. A throttled tree runs slowly; a quarantined one is held, frozen and cut off from the network until you release or kill it.

Why start in audit mode?

So it learns what normal looks like on your hosts before anything acts on it. A few days of audit mode turns up the tools that need allowlisting, which means enforce mode doesn't freeze your own backup job. It's also a working detector on its own: an incident is worth reading whether or not anything was stopped.

It quarantined something I need. Now what?

aegisctl incidents release <id>

That lifts the holds, thaws the tree and gives it its network back. Then allowlist what caught it, so it doesn't happen again. The process stays in its quarantine scope until it exits; see the threat model.

How is it different from Falco or Tracee?

Those emit an alert per rule match. Aegis adds signals up per process and across a process tree, with decay, so a single odd event stays quiet and a chain of them becomes one incident with all its evidence. Its allowlists also require the binary to verify against the RPM database or a pin, never a name. And in enforce mode it acts on what it finds, where they report it. It has five signals; Falco and Tracee ship far larger rule sets.

Which distributions does it support?

Rocky Linux 10, x86_64 and aarch64. Other EL10 rebuilds with a 6.12 kernel, BTF and the BPF LSM should work, but aren't tested. It needs the BPF LSM, cgroup v2 and kernel 6.12 or newer; aegisctl preflight checks all of these.

Does it work in containers?

aegisd runs on the host and sees processes inside containers too, since the probes are in the kernel. Binaries inside containers never verify, so allowlists don't apply to them. See the threat model.

How much does it cost to run?

Overhead hasn't been measured yet, so there are no numbers to quote. Measuring it is on the roadmap for v1.0.0. aegisd does its own work in one event loop, with up to four threads verifying binaries, up to 16 reading the environments of processes that predate it, one writing incidents, one carrying out enforce mode's actions, one sending OTLP batches when that sink is on, and one per webhook.

Will an update to a package cause false positives?

It shouldn't. After an update, the new binary is a new file, so aegisd verifies it again against the updated RPM database. A pinned binary is different: if you replace it, update the pin, or it verifies as modified.

Where's the web UI?

There isn't one. Use aegisctl, journald, or ship OTLP logs to the tools you already have.

Can I change the weights?

Yes, under [scoring.weights] in the config, and reload. Prefer an allowlist when you're trying to silence one tool; a weight change affects every process. See scoring.

How do I validate a config change before applying it?

aegisd --check-config

It exits 0 if the config and drop-ins are valid, or 78 with the file, line and column of the problem.

Does it send anything anywhere?

Only what you configure. journald is always on and local. The JSONL file, OTLP export and webhooks are off until you turn them on, and SELinux blocks network access until you enable aegisd_can_network_connect. aegisd never contacts anything else.

Why does the package require criu and nftables?

Enforce mode uses nftables to cut a quarantined tree off the network. criu is for live migration, planned for v0.4.0; nothing uses it yet.

Why is the eBPF code GPL?

The kernel only lets GPL-compatible eBPF programs use many of its helpers. The eBPF crate is GPL-2.0-only; everything in userspace is MIT OR Apache-2.0.

---

From docs/faq.md at v0.2.3.