Fix eBPF FIM whodata for Amazon Linux by Miguevrgo · Pull Request #37014 · wazuh/wazuh

Miguevrgo · 2026-06-18T13:27:09Z

Related issue
#36457

Description

This branch fixes an issue on older kernels, such as Amazon Linux 2023 and AL2, where the BPF
verifier rejects bpf_d_path() calls in LSM hooks, causing file events like create, write, and
delete to be silently dropped.

The previous workaround using kernel version guards has been removed. Instead, the bpf_d_path()
calls in the lsm/file_open and lsm/path_unlink hooks have been replaced with the existing
get_path_str_from_path() dentry-walk helper.

This completely removes the dependency on the verifier for path resolution and ensures that all file
events are correctly captured across all supported platforms without needing version fallbacks.

Evidence

System	Kernel	Hook	Create	Content	Meta	Delete	Result
Ubuntu 22.04	5.15.0-160-generic	kprobe	✅	✅	✅	✅	PASS
Ubuntu 26.04	7.0.0-22-generic	kprobe	✅	✅	✅	✅	PASS
Debian 13	6.12.48+deb13-amd64	LSM(dpath)	✅	✅	✅	✅	PASS
Fedora 43	6.17.7-300.fc43.x86_64	LSM(dpath)	✅	✅	✅	✅	PASS
Amazon Linux 2023	6.1.155-176.282.amzn2023	LSM(walk)	✅	✅	✅	✅	PASS
Amazon Linux 2	5.15.209-147.245.amzn2	LSM(walk)	✅	✅	✅	✅	PASS
Fedora 40	6.12.15-100.fc40.x86_64	LSM(dpath)	✅	✅	✅	✅	PASS
Ubuntu 24.04 (ARM)	6.17.0-1015-aws	LSM(dpath)	✅	✅	✅	✅	PASS

Logs

Ubuntu 22.04 — kernel 5.15.0-160-generic — kprobe

=== ubuntu22 ===
Ubuntu 22.04.5 LTS
kernel: 5.15.0-160-generic
lsm: lockdown,capability,landlock,yama,apparmor
---
2026/06/29 09:54:34 wazuh-syscheckd: INFO: (6047): Initializing eBPF driver for FIM whodata.
2026/06/29 09:54:34 wazuh-syscheckd: INFO: (6052): BPF LSM is not active (not present in /sys/kernel/security/lsm); falling back to kprobe hooks. To enable LSM-based capture append 'bpf' to the kernel boot parameter 'lsm=' and reboot.
2026/06/29 09:54:35 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: create file.
2026/06/29 09:54:35 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify content.
2026/06/29 09:54:35 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify metadata.
2026/06/29 09:54:35 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: delete file.
2026/06/29 09:54:35 wazuh-syscheckd: INFO: (6048): Healthcheck for eBPF FIM whodata module success.

Ubuntu 26.04 — kernel 7.0.0-22-generic — kprobe

=== ubuntu26 ===
Ubuntu 26.04 LTS
kernel: 7.0.0-22-generic
lsm: lockdown,capability,landlock,yama,apparmor,ima,evm
---
2026/06/29 09:54:42 wazuh-syscheckd: INFO: (6047): Initializing eBPF driver for FIM whodata.
2026/06/29 09:54:42 wazuh-syscheckd: INFO: (6052): BPF LSM is not active (not present in /sys/kernel/security/lsm); falling back to kprobe hooks. To enable LSM-based capture append 'bpf' to the kernel boot parameter 'lsm=' and reboot.
2026/06/29 09:54:45 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: create file.
2026/06/29 09:54:45 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify content.
2026/06/29 09:54:45 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify metadata.
2026/06/29 09:54:45 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: delete file.
2026/06/29 09:54:45 wazuh-syscheckd: INFO: (6048): Healthcheck for eBPF FIM whodata module success.

Debian 13 (trixie) — kernel 6.12.48+deb13-amd64 — LSM(dpath)

=== debian13 ===
Debian GNU/Linux 13 (trixie)
kernel: 6.12.48+deb13-amd64
lsm: lockdown,capability,landlock,yama,apparmor,tomoyo,bpf,ipe,ima,evm
---
2026/06/29 09:54:49 wazuh-syscheckd: INFO: (6047): Initializing eBPF driver for FIM whodata.
2026/06/29 09:54:49 wazuh-syscheckd: INFO: (6051): BPF LSM is active in the running kernel; using LSM hooks for create/modify/delete events.
2026/06/29 09:54:49 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: create file.
2026/06/29 09:54:49 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify content.
2026/06/29 09:54:49 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify metadata.
2026/06/29 09:54:49 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: delete file.
2026/06/29 09:54:49 wazuh-syscheckd: INFO: (6048): Healthcheck for eBPF FIM whodata module success.

Fedora 43 — kernel 6.17.7-300.fc43.x86_64 — LSM(dpath)

=== fedora43 ===
Fedora Linux 43 (Server Edition)
kernel: 6.17.7-300.fc43.x86_64
lsm: lockdown,capability,yama,selinux,bpf,landlock,ipe,ima,evm
---
�]3008;start=7a4c295a9e9b4396976fab60a3912b22;user=vagrant;hostname=fedora43;machineid=f30881f7091640339f5bbd3dc3537e9e;bootid=9ea8c24f9b514f1085a8094bd2ad7375;pid=9998;pidfdid=9999;comm=sudo;targetuser=root;type=session�\2026/06/29 09:54:56 wazuh-syscheckd: INFO: (6047): Initializing eBPF driver for FIM whodata.
2026/06/29 09:54:56 wazuh-syscheckd: INFO: (6051): BPF LSM is active in the running kernel; using LSM hooks for create/modify/delete events.
2026/06/29 09:54:57 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: create file.
2026/06/29 09:54:57 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify content.
2026/06/29 09:54:57 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify metadata.
2026/06/29 09:54:57 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: delete file.
2026/06/29 09:54:57 wazuh-syscheckd: INFO: (6048): Healthcheck for eBPF FIM whodata module success.
�]3008;end=7a4c295a9e9b4396976fab60a3912b22�\

Amazon Linux 2023 — kernel 6.1.155-176.282.amzn2023.x86_64 — LSM(walk)

=== amazonlinux2023 ===
Amazon Linux 2023.9.20251020
kernel: 6.1.155-176.282.amzn2023.x86_64
lsm: lockdown,capability,landlock,yama,safesetid,selinux,bpf
---
2026/06/29 09:55:01 wazuh-syscheckd: INFO: (6047): Initializing eBPF driver for FIM whodata.
2026/06/29 09:55:01 wazuh-syscheckd: INFO: (6051): BPF LSM is active in the running kernel; using LSM hooks for create/modify/delete events.
2026/06/29 09:55:02 wazuh-syscheckd: INFO: (6053): BPF LSM load failed with the bpf_d_path-based variants; retrying with the manual path walker (some kernels, e.g. Amazon Linux 2/2023, disallow bpf_d_path for these hooks).
2026/06/29 09:55:03 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: create file.
2026/06/29 09:55:03 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify content.
2026/06/29 09:55:03 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify metadata.
2026/06/29 09:55:03 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: delete file.
2026/06/29 09:55:03 wazuh-syscheckd: INFO: (6048): Healthcheck for eBPF FIM whodata module success.

Amazon Linux 2 — kernel 5.15.209-147.245.amzn2.x86_64 — LSM(walk)

=== amazonlinux2 ===
Amazon Linux 2
kernel: 5.15.209-147.245.amzn2.x86_64
lsm: lockdown,capability,yama,safesetid,selinux,bpf
---
2026/06/29 09:55:06 wazuh-syscheckd: INFO: (6047): Initializing eBPF driver for FIM whodata.
2026/06/29 09:55:06 wazuh-syscheckd: INFO: (6051): BPF LSM is active in the running kernel; using LSM hooks for create/modify/delete events.
2026/06/29 09:55:07 wazuh-syscheckd: INFO: (6053): BPF LSM load failed with the bpf_d_path-based variants; retrying with the manual path walker (some kernels, e.g. Amazon Linux 2/2023, disallow bpf_d_path for these hooks).
2026/06/29 09:55:09 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: create file.
2026/06/29 09:55:09 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify content.
2026/06/29 09:55:09 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify metadata.
2026/06/29 09:55:09 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: delete file.
2026/06/29 09:55:09 wazuh-syscheckd: INFO: (6048): Healthcheck for eBPF FIM whodata module success.

Fedora 40 — kernel 6.12.15-100.fc40.x86_64 — LSM(dpath)

=== fedora40 ===
Fedora Linux 40 (Forty)
kernel: 6.12.15-100.fc40.x86_64
lsm: lockdown,capability,yama,selinux,bpf,landlock,ipe,ima,evm
---
2026/06/29 09:55:12 wazuh-syscheckd: INFO: (6047): Initializing eBPF driver for FIM whodata.
2026/06/29 09:55:12 wazuh-syscheckd: INFO: (6051): BPF LSM is active in the running kernel; using LSM hooks for create/modify/delete events.
2026/06/29 09:55:12 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: create file.
2026/06/29 09:55:12 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify content.
2026/06/29 09:55:12 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify metadata.
2026/06/29 09:55:12 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: delete file.
2026/06/29 09:55:12 wazuh-syscheckd: INFO: (6048): Healthcheck for eBPF FIM whodata module success.

Ubuntu 24 ARM

2026/07/01 06:25:47 wazuh-logcollector: INFO: (1950): Analyzing file: '/var/log/dpkg.log'.
2026/07/01 06:25:47 wazuh-logcollector: INFO: Started (pid: 62777).
2026/07/01 06:25:47 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: create file.
2026/07/01 06:25:47 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify content.
2026/07/01 06:25:47 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: modify metadata.
2026/07/01 06:25:47 wazuh-syscheckd: INFO: (6049): eBPF healthcheck action succeeded: delete file.
2026/07/01 06:25:47 wazuh-syscheckd: INFO: (6048): Healthcheck for eBPF FIM whodata module success.
2026/07/01 06:25:47 wazuh-syscheckd: INFO: (6000): Starting daemon...
2026/07/01 06:25:47 wazuh-syscheckd: INFO: (6010): File integrity monitoring scan frequency: 43200 seconds

Artifacts Affected

wazuh-agentd (eBPF FIM whodata)

Configuration options

No configuration changes.

Logs/Alerts example

See evidence above.

Tests

Compilation without warnings in every supported platform
- Linux
- Windows
- MAC OS X

… the OS

…32466)

…LSM is active

…tion-4 Detect file move events into monitored folders in eBPF whodata mode

We are changing ebpf precompiled files, currently: 4.14.7 has 52 version 4.14.6 has 53 version To avoid any trouble in the future and with this precompiled versions, we are bumping to 54

Signed-off-by: Miguel Angel De la Vega Rodríguez <93781730+Miguevrgo@users.noreply.github.com>

Miguevrgo linked an issue Jun 18, 2026 that may be closed by this pull request

eBPF FIM whodata: bpf_d_path() not supported from LSM hooks on Amazon Linux kernels #36457

Closed

Miguevrgo and others added 3 commits June 25, 2026 10:23

local_branch_testing: push all changes

7c3bf76

fix: fallback if bpf_d_path is not allowed for the target LSM hook in…

6d915c7

… the OS

fix: make bpf_d_path inline and cleanup unused build scripts

a44e545

Miguevrgo force-pushed the fix/36457-ebpf-fim-whodata-4 branch from 2b9d2d0 to f73c0bb Compare June 25, 2026 08:23

Darioortegaleyva and others added 7 commits June 25, 2026 11:39

fix: add vfs_rename and path_rename hooks to detect file move events (#…

98fc4d1

…32466)

fix(fim): use local renamedata struct to avoid CO-RE BTF dependency

01c80df

fix: remove ENABLE_BPF_LSM guards and disable vfs_rename kprobe when …

db72fb5

…LSM is active

Merge pull request #37023 from wazuh/fix/32466-ebpf-rename-move-detec…

8b1bc23

…tion-4 Detect file move events into monitored folders in eBPF whodata mode

bump: bump deps version to 54

af26efb

We are changing ebpf precompiled files, currently: 4.14.7 has 52 version 4.14.6 has 53 version To avoid any trouble in the future and with this precompiled versions, we are bumping to 54

fix: rename for AM

ee0924d

Merge branch '4.14.7' into fix/36457-ebpf-fim-whodata-4

5363ca7

Signed-off-by: Miguel Angel De la Vega Rodríguez <93781730+Miguevrgo@users.noreply.github.com>

Miguevrgo self-assigned this Jun 29, 2026

Darioortegaleyva self-requested a review July 1, 2026 08:24

fix: update checkfiles

f7a4dda

Miguevrgo force-pushed the fix/36457-ebpf-fim-whodata-4 branch from 1c391e8 to 73d70d1 Compare July 1, 2026 08:39

MarcelKemp approved these changes Jul 1, 2026

View reviewed changes

Miguevrgo force-pushed the fix/36457-ebpf-fim-whodata-4 branch 2 times, most recently from b62f3de to f7a4dda Compare July 1, 2026 11:30

MarcelKemp approved these changes Jul 1, 2026

View reviewed changes

MarcelKemp merged commit abc4598 into 4.14.7 Jul 2, 2026
90 of 94 checks passed

MarcelKemp deleted the fix/36457-ebpf-fim-whodata-4 branch July 2, 2026 08:19

lchico mentioned this pull request Jul 4, 2026

Breaks "Check installed files" on all Linux agent packages #37413

Closed

Navigation Menu

Uh oh!

Fix eBPF FIM whodata for Amazon Linux - #37014

Fix eBPF FIM whodata for Amazon Linux#37014
MarcelKemp merged 11 commits into
4.14.7from
fix/36457-ebpf-fim-whodata-4

Miguevrgo commented Jun 18, 2026 •

edited

Loading

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Miguevrgo commented Jun 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Evidence

Logs

Artifacts Affected

Configuration options

Logs/Alerts example

Tests

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Miguevrgo commented Jun 18, 2026 •

edited

Loading