# Drop-in to enable the eBPF execve monitor.
# Install as:  /etc/systemd/system/enodia-sentinel.service.d/ebpf.conf
#
# The base unit is hardened for poll-only operation. bcc (the eBPF frontend)
# JIT-compiles its programs at load time and loads/attaches BPF, which the base
# unit's MemoryDenyWriteExecute and minimal capability set deliberately forbid.
# This drop-in relaxes exactly those, and nothing else — a conscious tradeoff:
# the event layer's value (catching short-lived processes) in exchange for a
# wider privilege surface. If you don't need it, don't install this file.

[Service]
# bcc compiles eBPF to native code at runtime -> needs write+exec memory.
MemoryDenyWriteExecute=no
# CAP_BPF/CAP_PERFMON: load BPF + open perf buffers. CAP_SYS_ADMIN: attach
# kprobes on many kernels. CAP_SYS_RESOURCE: raise the locked-memory limit.
AmbientCapabilities=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_BPF CAP_PERFMON CAP_SYS_ADMIN CAP_SYS_RESOURCE
CapabilityBoundingSet=CAP_SYS_PTRACE CAP_DAC_READ_SEARCH CAP_BPF CAP_PERFMON CAP_SYS_ADMIN CAP_SYS_RESOURCE