feat(agent): privilege-change probe — fentry on security_task_fix_setuid (JEF-54)

[thejefflarson]

What

A new eBPF probe captures privilege escalation to root and emits a new Behavior::PrivilegeChange { from_uid, to_uid } — Falco privilege-escalation-rule parity (ADR-0014).

How

• eBPF probe (agent/protector-agent-ebpf/src/main.rs): fentry on security_task_fix_setuid(struct cred *new, const struct cred *old, int flags). Reads new->uid.val and old->uid.val via bpf_probe_read_kernel (the cred -> kuid_t { val: u32 } pointer chase, same safe pattern as is_tmpfs; never bpf_d_path per JEF-68). Filters in-kernel to the escalation case (new_uid == 0 && old_uid != 0) so the ring carries only real gains of root. record_drop() on a reserve failure.
• common (agent/common/src/lib.rs): KIND_PRIV_CHANGE = 5 (wire value 4 reserved) + #[repr(C)] PrivEvent { header, old_uid, new_uid }.
• behavior (behavior/src/lib.rs): Behavior::PrivilegeChange { from_uid, to_uid }; fingerprint_key → priv:{to_uid} (stable); summary → privilege change uid {from_uid} -> {to_uid}.
• userspace (agent/protector-agent/src/observer.rs): RawEvent::PrivChange + a decode arm for KIND_PRIV_CHANGE + into_behavior; attached via the best-effort fentry table (fix_setuid / security_task_fix_setuid); stays on the decoupled drain→worker path (JEF-64).
• engine (engine/src/engine/reason/proof.rs): corroborates() returns false for PrivilegeChange — model evidence, not blanket corroboration. Per-objective corroboration is JEF-49.

Validation

• cargo +nightly check (eBPF crate): clean.
• Repo root + agent/: cargo build / test / clippy --all-targets -- -D warnings / fmt — all green (warnings = errors).
• New unit test: KIND_PRIV_CHANGE decodes to PrivilegeChange { from_uid, to_uid } and into_behavior maps it through.
• docker build -f agent/Dockerfile --target builder — EXIT 0 (compiles the eBPF object via bpf-linker and builds protector-agent --features ebpf).

Concerns

• Verifier-accept is on-node only (JEF-68): the Docker build confirms compile + bpf-linker, but the in-kernel verifier only runs when the probe attaches on a real node.
• Hook symbol: security_task_fix_setuid is the chosen LSM hook (the credential-fix path where setuid lands). It's attached best-effort — if it isn't fentry-attachable on 6.8, the agent logs and continues; security_capset / the setuid path remain documented fallbacks. The escalation-to-root signal is the goal.

🤖 Generated with Claude Code

https://claude.ai/code/session_01VtjoJttCvBY4dzCoE4f9vP