Conversation
Correlate raw syscall entry and exit with mm_access target enrichment. Preserve unresolved attempts, flags and signed results; snapshot at most eight local and remote vectors with explicit completeness and overflow status. Use a feature-gated bounded map, count insertion failures and clean every exiting thread. Public collection remains disabled in this core change.
This was referenced Sep 16, 2026
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Part 1 of 3, bottom-up: private probes → public event and tests → Go bindings.
Summary
Supersedes #416. Collect process_vm_readv/writev syscall results through ABI-aware raw entry/exit hooks, enriched with the task resolved by mm_access before credential/dumpability checks. This retains early failures that an LSM-only observation would miss. Parent/child accesses remain visible; resolved same-group accesses are suppressed.
This first layer is private. Correlation uses a gated bounded per-thread map with lifetime validation, exit cleanup and insertion-failure accounting. User-vector reads are bounded snapshots, never authoritative accessed ranges. The following layer exposes the event and regression tests.
Issue: https://github.com/elastic/endpoint-dev/issues/21204
Validation
Preflight:
20260916-pva-v2-release-final. Fleet acceptance:20260916T172021Z-process-vm-access, accepted buildendpoint-9.4.2-5564d77d41a8132d(Stack/Agent/Endpoint 9.4.2). Main integration was validated separately. Full persona-volume gate explicitly waived by the user; no production-volume claim.The complete stack passes native x64/ARM64 tests, forced eBPF kprobe attachment, RHEL 8 and exact Rocky 9.3 with CI bytecode. ia32 is exercised; x32 is explicitly skipped where unavailable, and AArch32 runtime coverage is not claimed. Legacy kprobe capture remains unsupported.
Companions: elastic/endpoint-package#800 · https://github.com/elastic/endpoint-dev/pull/22027