Rebase sensor-base-0.7.0 onto upstream v0.76.7

.github/workflows/go.yml

@@ -19,6 +19,8 @@ jobs:
 
     - name: Check out code into the Go module directory
       uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd
+      with:
+        submodules: recursive
 
     - name: Set up Go 1.25
       uses: actions/setup-go@4a3601121dd01d1626a1e23e37211e3254c1c06c
@@ -36,7 +38,7 @@ jobs:
         go get -v -t -d ./...
         sudo apt-get update
         sudo apt-get upgrade
-        sudo apt-get install mingw-w64-x86-64-dev gcc-mingw-w64-x86-64 gcc-mingw-w64
+        sudo apt-get install mingw-w64-x86-64-dev gcc-mingw-w64-x86-64 gcc-mingw-w64 gcc-aarch64-linux-gnu libsystemd-dev clang-12 llvm libelf-dev git make libzstd-dev
 
     - name: Use Node.js
       uses: actions/setup-node@48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e
@@ -52,12 +54,17 @@ jobs:
       # Uncomment the architectures you want here. NOTE: DarwinBase
       # does not include yara or modules with C compilers needed.
       run: |
-        mkdir ./output/
+        mkdir -p ./output/ ./third_party/libbpfgo/output
         export PATH=$PATH:~/go/bin/
         go run make.go -v UpdateDependentTools
-        go run make.go -v DarwinBase
+        go run make.go -v Linux
+        BUILD_BPF_PLUGINS=0 go run make.go -v Linux
+        go run make.go -v Linux
+        cp vql/linux/bpf/vmlinux_h/x86_64-vmlinux.h third_party/libbpfgo/output/vmlinux.h
+        BUILD_BPF_PLUGINS=1 go run make.go -v Linux
+        go run make.go -v Linux
+        go run make.go -v LinuxArm64
         go run make.go -v Windows
-        go run make.go -v WindowsSumo
         go run make.go -v Windowsx86
 
     - name: StoreBinaries

.github/workflows/linux.yml

@@ -0,0 +1,58 @@
+# Only trigger when a PR is committed.
+name: Linux
+on: [pull_request]
+
+jobs:
+  build:
+    name: Test
+    # We used to build on ubuntu-18.04 but that is now deprecated by
+    # GitHub. Earlier distributions will have to use the musl build.
+    runs-on: ubuntu-22.04
+    steps:
+
+    - name: Check out code and submodules into the Go module directory
+      uses: actions/checkout@v2
+      with:
+        submodules: recursive
+
+    - uses: actions/setup-go@v2
+      with:
+        go-version: '^1.26'
+
+    - run: go version
+
+    - name: Get dependencies
+      run: |
+        go get -v -t -d ./...
+        sudo apt-get update
+        sudo apt-get install libsystemd-dev clang llvm libelf-dev git make libzstd-dev
+
+    - name: Build GUI-less binary
+      run: |
+        mkdir ./output/
+        export PATH=$PATH:~/go/bin/
+        make linux_bare
+
+    - name: Run built-in testcases
+      run: |
+        echo "Running built-in tests."
+        go test -race -v --tags server_vql $(go list ./... | grep -v vql/linux/.*bpf)
+    - name: Test Golden Generic
+      if: always()
+      run: |
+        echo "Running OS generic tests."
+
+        output/velociraptor* -v golden artifacts/testdata/server/testcases/ --env srcDir=`pwd` --config artifacts/testdata/windows/test.config.yaml
+
+    - name: Test Golden Linux
+      if: always()
+      run: |
+        echo "Running Linux tests."
+
+        output/velociraptor* -v golden artifacts/testdata/linux/ --env srcDir=`pwd` --config artifacts/testdata/windows/test.config.yaml
+
+    - name: StoreBinaries
+      uses: actions/upload-artifact@v4
+      with:
+        name: Binaries.zip
+        path: output

.gitignore

@@ -28,3 +28,11 @@ __debug*
 debug.test*
 artifacts/testdata/server/hunts/H.*
 artifacts/testdata/server/users/
+.*sw?
+.vim*
+.env
+SUSE/docker-compose/config/traefik/traefik.toml
+SUSE/docker-compose/config/velociraptor/*
+SUSE/docker-compose/data/velociraptor/*
+SUSE/docker-compose/logs/velociraptor/*
+vql/linux/bpf/*/*.bpf.o

.gitmodules

@@ -0,0 +1,3 @@
+[submodule "third_party/libbpfgo"]
+	path = third_party/libbpfgo
+	url = https://github.com/aquasecurity/libbpfgo