test(execd): close OSEP-0018 R-q/R-s/R-l(b)/R-m/R-u e2e gaps + ebpf smoke

.github/workflows/detect-changes.yml

@@ -79,6 +79,7 @@ jobs:
                 path === "scripts/python-k8s-execd-init-e2e.sh" ||
                 path === "tests/python/tests/test_execd_init_e2e.py" ||
                 path === "tests/python/tests/test_execd_hardening_e2e.py" ||
+                path === "tests/python/tests/test_execd_k8s_restart_recycle_e2e.py" ||
                 path === "server/opensandbox_server/examples/e2e.batchsandbox-template.yaml" ||
                 path.startsWith("components/execd/") ||
                 path.startsWith("kubernetes/charts/"),
@@ -89,7 +90,8 @@ jobs:
               execd: (path) =>
                 workflowChanged(path, "execd-test.yml") ||
                 path.startsWith("components/execd/") ||
-                path.startsWith("components/internal/"),
+                path.startsWith("components/internal/") ||
+                path === "scripts/execd-ebpf-smoke.sh",
               nodeagent: (path) =>
                 workflowChanged(path, "nodeagent-test.yml") ||
                 path.startsWith("components/nodeagent/") ||

.github/workflows/execd-test.yml

@@ -58,8 +58,20 @@ jobs:
       - name: Run execd-ebpf variant tests
         working-directory: components/execd
         run: |
+          # Regenerate the per-arch bytecode first: the generated files are
+          # build artifacts (not committed), so local tests need them too.
+          sudo apt-get update -qq && sudo apt-get install -y -qq clang >/dev/null
+          make generate-ebpf ARCH=$(go env GOARCH)
           CGO_ENABLED=1 go test -tags ebpf -count=1 ./pkg/ebpf/
 
+      - name: Upload per-arch vmlinux.h (for bytecode regeneration)
+        if: runner.os == 'Linux' && always()
+        uses: actions/upload-artifact@v7
+        with:
+          name: vmlinux-${{ runner.arch }}
+          path: /tmp/ebpf-dump/vmlinux.h
+          if-no-files-found: ignore
+
       - name: Calculate coverage and generate summary
         working-directory: components/execd
         id: coverage
@@ -84,7 +96,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [ubuntu-latest, windows-latest]
+        os: [ubuntu-latest, windows-latest, self-hosted]
     runs-on: ${{ matrix.os }}
     defaults:
       run:
@@ -135,14 +147,27 @@ jobs:
           chmod +x components/execd/tests/smoke_bwrap.sh
           bash components/execd/tests/smoke_bwrap.sh
 
-      - name: Init-mode container regression (OSEP-0018)
+      - name: Init-mode container regression
         if: matrix.os == 'ubuntu-latest'
         shell: bash
         timeout-minutes: 30
         run: |
           chmod +x components/execd/tests/init_container.sh
           bash components/execd/tests/init_container.sh
 
+      - name: Execd eBPF bare-container smoke
+        if: matrix.os != 'windows-latest'
+        shell: bash
+        timeout-minutes: 30
+        run: |
+          # Runs the execd-ebpf variant in a bare container against THIS
+          # runner's kernel and asserts exec/connect/privilege events land in
+          # the JSONL audit file. GitHub-hosted ubuntu validates the stock CI
+          # kernel; the self-hosted leg is the 5.10 empirical validation
+          # (inline-filename exec-hook fallback). Host prerequisites (BTF,
+          # cgroup v2, tracefs) are prechecked by the script.
+          bash scripts/execd-ebpf-smoke.sh --build
+
       - name: Show logs
         if: always()
         run: |
@@ -240,9 +265,9 @@ jobs:
       - name: Run isolated session init-mode reaper integration test
         working-directory: components/execd
         run: |
-          # bwrap lifecycle under init-mode reaper dispatch (OSEP-0018 R-o):
-          # the pre-reap barrier must serialize process-group teardown with
-          # the reaper's observe/consume while execd owns wait4.
+          # bwrap lifecycle under init-mode reaper dispatch: the pre-reap
+          # barrier must serialize process-group teardown with the reaper's
+          # observe/consume while execd owns wait4.
           sudo -E env "PATH=$PATH" go test \
             -tags="linux,bwrap" -v -count=1 -timeout=3m \
             -run '^TestIsolatedSessionWithInitReaper$' \

components/execd/Dockerfile

@@ -102,10 +102,17 @@ RUN rm /usr/lib/libcap.so /usr/lib/libcap.so.2 && \
 # defaulting to /opt/opensandbox/execd). The variant attaches
 # exec/connect/privilege audit hooks and needs CAP_BPF + CAP_PERFMON in the
 # container ceiling.
+#
+# The CO-RE audit bytecode is REGENERATED here at image build time with
+# bpf2go. prog/audit_types.h declares only the kernel members the programs
+# touch (resolved by name against the target kernel BTF at load time), so
+# no per-arch vmlinux.h or host kernel BTF is needed — this stage is fully
+# hermetic and cross-compiles for every TARGETARCH.
 FROM golang:1.25.9 AS ebpf-builder
 ARG VERSION=dev
 ARG GIT_COMMIT=unknown
 ARG BUILD_TIME=unknown
+ARG TARGETARCH
 RUN apt-get update && apt-get install -y --no-install-recommends clang
 WORKDIR /build
 COPY components/internal/go.mod components/internal/go.sum ./components/internal/
@@ -115,6 +122,15 @@ RUN cd components/execd && go mod download
 COPY components/internal ./components/internal
 COPY components/execd ./components/execd
 WORKDIR /build/components/execd
+# Generate the CO-RE bytecode for this TARGETARCH (bpf2go embeds it into
+# audit_bpf_<arch>.go, picked up by the Go build tags). clang's bpf target
+# only — no host kernel BTF.
+RUN go run github.com/cilium/ebpf/cmd/bpf2go@v0.16.0 \
+       -cc clang -no-strip \
+       -cflags "-Ipkg/ebpf/prog" \
+       -target "${TARGETARCH}" \
+       -go-package ebpf -output-dir pkg/ebpf \
+       audit pkg/ebpf/prog/audit.bpf.c
 # cilium/ebpf is pure Go, so the variant builds fully static.
 RUN CGO_ENABLED=0 go build -tags ebpf -trimpath -buildvcs=false \
     -ldflags "-buildid= -B none \

components/execd/Makefile

@@ -155,9 +155,35 @@ build-ebpf: ## Build the execd-ebpf observation variant (CGO + cilium/ebpf).
 		exit 1; \
 	fi
 	@mkdir -p bin
+	$(MAKE) generate-ebpf ARCH=$(shell go env GOARCH)
 	CGO_ENABLED=1 go build -tags ebpf $(GO_BUILD_FLAGS) -ldflags "$(GO_LDFLAGS)" -o bin/execd-ebpf main.go
 	@echo "built bin/execd-ebpf"
 
+# Regenerate the CO-RE audit bytecode for one architecture from
+# prog/audit.bpf.c + prog/audit_types.h. The types header declares only the
+# kernel members the programs touch (resolved by name against the target
+# kernel BTF at load time), so no vmlinux.h is needed and the bytecode is
+# hermetic across architectures (issue #1563).
+#
+#   make generate-ebpf ARCH=amd64   # or arm64; defaults to GOARCH
+#
+# Requires clang with the bpf target. bpf2go writes audit_bpf_<target>.{go,o};
+# the Go build picks the right one via build tags.
+.PHONY: generate-ebpf
+ARCH ?= $(shell go env GOARCH)
+generate-ebpf:
+	@case "$(ARCH)" in \
+		amd64|arm64) ;; \
+		*) echo "generate-ebpf: unsupported ARCH=$(ARCH) (amd64|arm64)" >&2; exit 1 ;; \
+	esac
+	go run github.com/cilium/ebpf/cmd/bpf2go@v0.16.0 \
+		-cc clang -no-strip \
+		-cflags "-Ipkg/ebpf/prog" \
+		-target $(ARCH) \
+		-go-package ebpf -output-dir pkg/ebpf \
+		audit pkg/ebpf/prog/audit.bpf.c
+	@echo "regenerated pkg/ebpf/audit_bpf_$(ARCH).{go,o}"
+
 .PHONY: test-integration
 test-integration: ## Run integration tests (Linux + bwrap required).
 	go test -v -tags="linux,bwrap" -run Integration ./pkg/runtime/bwrap_test/

components/execd/configs/isolation.custom.toml

@@ -0,0 +1,29 @@
+# Copyright 2026 Alibaba Group Holding Ltd.
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Custom-policy hardening configuration for the execd-as-init e2e: a
+# [seccomp] deny override (which REPLACES the built-in denylist) plus
+# keep_capabilities. Proves both overrides reach the workload:
+#   - the denied syscall family (chmod/fchmodat/fchmodat2; glibc coreutils
+#     chmod uses fchmodat, busybox uses chmod) fails with EACCES in /command
+#   - CAP_NET_RAW (bit 13) is raised in the ambient set and survives execve,
+#     so the workload reports CapEff=0x2000
+# Landlock stays off: this variant is about the seccomp/caps overrides only.
+
+[hardening]
+enabled = true
+keep_capabilities = ["CAP_NET_RAW"]
+
+[seccomp]
+deny = ["chmod", "fchmodat", "fchmodat2"]