kb checker

kb-checker — Safety & Integrity Enforcement Layer

Language: Rust · Primary Maintainer: Pardhu Varma — Systems & Security (Rust) · Collaborator: Tejaswini — Defensive Security

Rust-based safety and integrity enforcement layer for Kernel Borderlands. Operates independently of the behavioral analytics pipeline to continuously verify the integrity and health of critical KB components. It validates the runtime state of eBPF programs, monitors the Control Plane, AADS subsystem, and native services, quarantines or isolates compromised components when necessary, and generates alerts for administrative review. Its purpose is to ensure that the Kernel Borderlands infrastructure itself remains trusted, resilient, and operational.

Three Enforcement Protocol Layers

1. Program State Verification — validates eBPF active program configurations and bytecodes in kernel memory.
2. Control Plane Audits — continuously checks Go UDS sockets and process health.
3. Swarm Verification — verifies Ray container execution states and consensus messaging health.

Structure

kb-checker/
├── src/
│   ├── main.rs             CLI entry point
│   ├── lib.rs              Library exports
│   ├── integrity/          eBPF and runtime component integrity validation
│   ├── service_check/      KB service health checker
│   ├── report/             Safety alerts and status report generation
│   └── grpc/               Optional gRPC server mode
├── event_sets/             JSON threat simulation scenarios
└── tests/

Threat Simulation Event Sets (event_sets/)

JSON threat models used by the integrity validator to test rules and behavior pipelines under controlled simulation profiles.

Set	Purpose
privilege_escalation.json	setuid/setcap sequences
reverse_shell.json	socket → connect → dup2 → execve
lateral_movement.json	network scanning + SSH
credential_access.json	/etc/shadow access
memory_exploit.json	mmap/mprotect RWX patterns
normal_nginx.json	Benign nginx traffic (should NOT trigger)
normal_postgres.json	Benign postgres traffic (should NOT trigger)

Format:

{
  "name": "reverse_shell",
  "should_trigger": true,
  "description": "Classic reverse shell pattern",
  "events": [
    {"type": "exec", "pid": 1234, "comm": "bash", "ppid": 999},
    {"type": "network", "pid": 1234, "dst": "192.168.1.100", "port": 4444}
  ]
}

Build & Run

cd kb-checker
cargo build --release
./target/release/kb-checker monitor --all

Tests

cargo test

See also: kb-control-plane, kb-aads, Architecture.