Add event-driven eBPF execve layer with a Snort-style rule engine

Closes polling's blind spot (processes that exit between sweeps) with a real
eBPF probe and a declarative, data-driven detection engine — inspired by Snort
(rule language, signature IDs) and OSSEC (host-IDS framing).

New events/ subpackage:
- bcc_source.py : eBPF C tracing execve (filename, argv[1..2], ppid, uid,
                  parent comm) over a perf buffer, loaded via bcc; lazy import
                  + available()/try-except so it fails closed to poll-only when
                  bcc/root/BTF are absent — a broken probe never downs the daemon
- exec_event.py : the ExecEvent type
- rules.py      : ExecRule (sid/msg/severity/classtype + path/exec/parent/argv
                  conditions) and ExecRuleEngine; 4 shipped rules (fileless exec
                  100001, reverse-shell argv 100002, web/DB→shell RCE 100003,
                  curl|sh 100004); operators add more via exec_rules_file TOML
- monitor.py    : runs the source on a thread, routes events through the engine

Integration:
- daemon starts the monitor, shares a lock-guarded cooldown with the sweep
  loop, and feeds event alerts into the same snapshot pipeline
- Alert gains Snort-style sid + classtype; retrofitted onto all 7 poll
  detectors; snapshots and JSON now carry them
- config: ebpf_exec_monitor (default on, degrades), exec_rules_file
- systemd: opt-in ebpf.conf drop-in (relaxes MemoryDenyWriteExecute + widens
  caps for bcc's JIT) so the base unit stays hardened for poll-only
- sentinel-redteam: ebpf_exec drill (short-lived /tmp exec + /dev/tcp argv the
  poller can't see); footer now uses the Python CLI

Tests: +14 cases for the rule engine (each default rule match/non-match, rule
validation, parent-exclude). 39/39 pass. Graceful non-root degradation verified.

NOTE: the eBPF C follows bcc's execsnoop pattern but could not be run here
(BPF needs root); it wants a root smoke-test on a real host.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

enodia_sentinel/daemon.py

@@ -23,6 +23,10 @@ class Sentinel:
         self.cfg = cfg
         self.start_time = time.time()
         self.cooldowns: dict[str, float] = {}
+        # Cooldowns are touched by both the sweep loop and the eBPF event
+        # thread, so guard them.
+        self._cooldown_lock = threading.Lock()
+        self._exec_monitor = None
         self.last_persist_scan = self.start_time
         self.listener_baseline: set[str] = set()
         self.suid_baseline: set[str] = set()
@@ -99,15 +103,24 @@ class Sentinel:
         return alerts
 
     def fresh_alerts(self, alerts: list[Alert], now: float) -> list[Alert]:
-        """Drop alerts whose dedup key is still within cooldown."""
+        """Drop alerts whose dedup key is still within cooldown (thread-safe)."""
         out = []
-        for a in alerts:
-            prev = self.cooldowns.get(a.key, 0.0)
-            if (now - prev) >= self.cfg.cooldown:
-                self.cooldowns[a.key] = now
-                out.append(a)
+        with self._cooldown_lock:
+            for a in alerts:
+                prev = self.cooldowns.get(a.key, 0.0)
+                if (now - prev) >= self.cfg.cooldown:
+                    self.cooldowns[a.key] = now
+                    out.append(a)
         return out
 
+    def _on_exec_alert(self, alert: Alert) -> None:
+        """Callback for the eBPF exec monitor — same dedup + capture path."""
+        fresh = self.fresh_alerts([alert], time.time())
+        if fresh:
+            threading.Thread(
+                target=self._capture, args=(fresh,), daemon=True
+            ).start()
+
     # -- main loop ---------------------------------------------------------
     def run(self) -> None:
         self.cfg.log_dir.mkdir(parents=True, exist_ok=True)
@@ -115,6 +128,7 @@ class Sentinel:
             fh.write(f"{time.strftime('%FT%T%z')} enodia-sentinel started\n")
         self.build_baselines()
         snapshot.prune(self.cfg)
+        self._start_exec_monitor()
         sweeps = 0
         while not self._stop.is_set():
             now = time.time()
@@ -134,6 +148,18 @@ class Sentinel:
                 snapshot.prune(self.cfg)
             self._stop.wait(self.cfg.sample_interval)
 
+    def _start_exec_monitor(self) -> None:
+        if not self.cfg.ebpf_exec_monitor:
+            return
+        from .events.monitor import ExecMonitor
+        self._exec_monitor = ExecMonitor(self.cfg, self._on_exec_alert)
+        ok, reason = self._exec_monitor.start()
+        with open(self.cfg.events_log, "a") as fh:
+            status = "enabled" if ok else f"disabled ({reason})"
+            fh.write(f"{time.strftime('%FT%T%z')} eBPF exec monitor: {status}\n")
+        if not ok:
+            self._exec_monitor = None
+
     def _capture(self, alerts: list[Alert]) -> None:
         try:
             snapshot.capture(alerts, SystemState(), self.cfg)
@@ -143,3 +169,5 @@ class Sentinel:
 
     def stop(self, *_a) -> None:
         self._stop.set()
+        if self._exec_monitor is not None:
+            self._exec_monitor.stop()