[业务进程] --(syscall: open/unlink/rename)--> [VFS Layer] 
      |                                            |
      |                                            v
      |                                     [LSM Hook Points]
      |                                            |
      |                                            v
      |                                     [eBPF Program (Kernel)]
      |                                      - 上下文提取 (pid, uid, comm, path, inode, op)
      |                                      - 策略匹配 (Map Lookup: 白名单/目标路径)
      |                                      - 结构体构建 (struct audit_event)
      |                                            |
      |                                            v (Ring Buffer / BPF_MAP_TYPE_RINGBUF)
      |                                     [User-Space Daemon (Go/Rust/C++)]
      |                                      - 解码/富化 (容器ID映射、K8s元数据、进程树)
      |                                      - 签名/哈希链 (Ed25519 / SM3 国密)
      |                                      - 落地存储 (Kafka -> ClickHouse / Elasticsearch / WORM存储 / 区块链锚定)
      |                                            |
      v                                            v
[合规报表/告警/审计平台] <------------------ [不可篡改审计日志库]

// common.h - 内核态与用户态共享
#pragma once

#define MAX_PATH_LEN 256
#define MAX_COMM_LEN 16
#define AUDIT_OP_OPEN    1
#define AUDIT_OP_UNLINK  2
#define AUDIT_OP_RENAME  3
#define AUDIT_OP_MKDIR   4
#define AUDIT_OP_RMDIR   5
#define AUDIT_OP_PERM    6 // 权限检查(读/写/执行)

struct audit_event {
    __u64 timestamp_ns;      // 纳秒时间戳
    __u32 pid;               // 进程 ID
    __u32 tid;               // 线程 ID
    __u32 uid;               // 用户 ID
    __u32 gid;               // 组 ID
    __u32 ppid;              // 父进程 ID
    __u32 op_type;           // 操作类型
    __u32 result;            // 返回值 (0=success, <0=errno)
    __u64 inode;             // 目标文件 Inode
    __u32 dev;               // 设备号
    __u32 mode;              // 文件模式/权限
    char comm[MAX_COMM_LEN]; // 进程名
    char path[MAX_PATH_LEN]; // 文件路径 (相对挂载点或绝对路径)
    char old_path[MAX_PATH_LEN]; // rename 旧路径
    // 扩展字段：容器 ID、K8s Pod Name 等可通过 Map 映射在用户态富化
};

// Ring Buffer Map 定义
struct {
    __uint(type, BPF_MAP_TYPE_RINGBUF);
    __uint(max_entries, 1 << 24); // 16MB 环形缓冲区
} audit_rb SEC(".maps");

// 策略配置 Map：Key=Inode(或路径哈希), Value=规则位图
struct {
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
    __uint(max_entries, 4096);
    __type(key, __u64); // Inode 或 Path Hash
    __type(value, __u32); // Bitmask: BIT(OP_OPEN) | BIT(OP_UNLINK) ...
} audit_policy SEC(".maps");

// 进程白名单 Map：Key=PID, Value=1 (跳过审计)
struct {
    __uint(type, BPF_MAP_TYPE_LRU_HASH);
    __uint(max_entries, 2048);
    __type(key, __u32);
    __type(value, __u8);
} pid_whitelist SEC(".maps");

// lsm_audit.bpf.c
#include "vmlinux.h" // bpftool btf dump 生成
#include <bpf/bpf_helpers.h>
#include <bpf/bpf_tracing.h>
#include <bpf/bpf_core_read.h>
#include "common.h"

SEC("lsm/file_open")
int BPF_PROG(lsm_file_open, struct file *file, int ret)
{
    // 1. 仅审计成功的打开 (ret == 0)，或按需审计失败
    if (ret != 0) return 0;

    // 2. 白名单过滤 (性能关键，最先执行)
    __u32 pid = bpf_get_current_pid_tgid() >> 32;
    if (bpf_map_lookup_elem(&pid_whitelist, &pid)) return 0;

    // 3. 获取文件路径与 Inode (安全读取内核指针)
    struct dentry *dentry = BPF_CORE_READ(file, f_path.dentry);
    struct inode *inode = BPF_CORE_READ(dentry, d_inode);
    __u64 ino = BPF_CORE_READ(inode, i_ino);
    __u32 dev = BPF_CORE_READ(inode, i_sb, s_dev);

    // 4. 策略匹配：仅审计受监控目录/文件
    __u32 *policy = bpf_map_lookup_elem(&audit_policy, &ino);
    if (!policy || !(*policy & (1 << AUDIT_OP_OPEN))) return 0;

    // 5. 从 Ring Buffer 保留空间
    struct audit_event *evt = bpf_ringbuf_reserve(&audit_rb, sizeof(*evt), 0);
    if (!evt) return 0; // 缓冲区满，丢弃 (可配置统计计数器)

    // 6. 填充上下文
    evt->timestamp_ns = bpf_ktime_get_ns();
    evt->pid = pid;
    evt->tid = (__u32)bpf_get_current_pid_tgid();
    __u64 uid_gid = bpf_get_current_uid_gid();
    evt->uid = (__u32)uid_gid;
    evt->gid = uid_gid >> 32;
    
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
    evt->ppid = BPF_CORE_READ(task, real_parent, tgid);
    bpf_get_current_comm(&evt->comm, MAX_COMM_LEN);
    
    evt->op_type = AUDIT_OP_OPEN;
    evt->result = ret;
    evt->inode = ino;
    evt->dev = dev;
    evt->mode = BPF_CORE_READ(inode, i_mode);
    
    // 获取路径 (d_path 辅助函数需 kernel 5.10+，或手动遍历 dentry)
    // 此处简化：使用 bpf_d_path (需内核支持) 或预存路径映射
    // 示例：bpf_d_path(&file->f_path, evt->path, MAX_PATH_LEN);
    
    // 7. 提交事件
    bpf_ringbuf_submit(evt, 0);
    return 0;
}

SEC("lsm/inode_unlink")
int BPF_PROG(lsm_inode_unlink, struct inode *dir, struct dentry *dentry, int ret)
{
    if (ret != 0) return 0; // 仅记录成功删除
    
    __u32 pid = bpf_get_current_pid_tgid() >> 32;
    if (bpf_map_lookup_elem(&pid_whitelist, &pid)) return 0;

    struct inode *target_inode = BPF_CORE_READ(dentry, d_inode);
    __u64 ino = BPF_CORE_READ(target_inode, i_ino);
    
    __u32 *policy = bpf_map_lookup_elem(&audit_policy, &ino);
    if (!policy || !(*policy & (1 << AUDIT_OP_UNLINK))) return 0;

    struct audit_event *evt = bpf_ringbuf_reserve(&audit_rb, sizeof(*evt), 0);
    if (!evt) return 0;

    evt->timestamp_ns = bpf_ktime_get_ns();
    evt->pid = pid;
    evt->tid = (__u32)bpf_get_current_pid_tgid();
    __u64 uid_gid = bpf_get_current_uid_gid();
    evt->uid = (__u32)uid_gid;
    evt->gid = uid_gid >> 32;
    struct task_struct *task = (struct task_struct *)bpf_get_current_task();
    evt->ppid = BPF_CORE_READ(task, real_parent, tgid);
    bpf_get_current_comm(&evt->comm, MAX_COMM_LEN);
    
    evt->op_type = AUDIT_OP_UNLINK;
    evt->result = ret;
    evt->inode = ino;
    evt->dev = BPF_CORE_READ(target_inode, i_sb, s_dev);
    evt->mode = BPF_CORE_READ(target_inode, i_mode);
    // 获取被删文件路径
    // bpf_d_path(...)

    bpf_ringbuf_submit(evt, 0);
    return 0;
}

// License & Version
char LICENSE[] SEC("license") = "GPL";

// main.go - 核心逻辑骨架
package main

import (
    "encoding/binary"
    "encoding/json"
    "log"
    "os"
    "os/signal"
    "syscall"
    "time"

    "github.com/cilium/ebpf"
    "github.com/cilium/ebpf/link"
    "github.com/cilium/ebpf/ringbuf"
    "github.com/cilium/ebpf/rlimit"
    "golang.org/x/crypto/ed25519"
)

//go:generate go run github.com/cilium/ebpf/cmd/bpf2go -target bpfel -cc clang lsm ./bpf/lsm_audit.bpf.c -- -I./headers

type AuditEvent struct {
    TimestampNs uint64 `json:"ts"`
    Pid         uint32 `json:"pid"`
    Tid         uint32 `json:"tid"`
    Uid         uint32 `json:"uid"`
    Gid         uint32 `json:"gid"`
    Ppid        uint32 `json:"ppid"`
    OpType      uint32 `json:"op"`
    Result      int32  `json:"ret"`
    Inode       uint64 `json:"ino"`
    Dev         uint32 `json:"dev"`
    Mode        uint32 `json:"mode"`
    Comm        string `json:"comm"`
    Path        string `json:"path"`
    OldPath     string `json:"old_path,omitempty"`
    // 合规扩展字段
    Signature   string `json:"sig,omitempty"`    // Ed25519 签名
    PrevHash    string `json:"prev_hash,omitempty"` // 哈希链指针
}

func main() {
    // 1. 提升 RLIMIT_MEMLOCK
    if err := rlimit.RemoveMemlock(); err != nil {
        log.Fatalf("Memlock: %v", err)
    }

    // 2. 加载 eBPF 对象 (bpf2go 生成)
    objs := lsmObjects{}
    if err := loadLsmObjects(&objs, nil); err != nil {
        log.Fatalf("Load objs: %v", err)
    }
    defer objs.Close()

    // 3. 挂载 LSM Hooks (需 CAP_SYS_ADMIN + CAP_BPF + Kernel CONFIG_BPF_LSM=y)
    // 注意：LSM hook 挂载通常需要内核命令行参数 `lsm=landlock,lockdown,yama,apparmor,bpf` 中包含 bpf
    // 且 /sys/kernel/security/bpf 可访问
    links := make([]link.Link, 0)
    progs := map[string]*ebpf.Program{
        "lsm_file_open":   objs.LsmFileOpen,
        "lsm_inode_unlink": objs.LsmInodeUnlink,
        // ... 添加 rename, mkdir, permission 等
    }
    for name, prog := range progs {
        l, err := link.AttachLSM(link.LSMOptions{Program: prog})
        if err != nil {
            log.Printf("WARN: Attach %s failed: %v (Kernel may not support LSM BPF or hook name mismatch)", name, err)
            continue
        }
        links = append(links, l)
        log.Printf("Attached LSM Hook: %s", name)
    }
    defer func() { for _, l := range links { l.Close() } }()

    // 4. 配置策略 Map (示例：监控 /data/recordings 目录下所有文件)
    // 实际生产建议：启动时遍历目标目录 Inode 填充 Map，或用户态监听创建事件动态更新
    targetInode := uint64(123456) // 示例 Inode
    policyVal := uint32(1<<AUDIT_OP_OPEN | 1<<AUDIT_OP_UNLINK | 1<<AUDIT_OP_RENAME)
    if err := objs.AuditPolicy.Put(targetInode, policyVal); err != nil {
        log.Printf("Policy update failed: %v", err)
    }

    // 5. 密钥初始化 (生产环境对接 KMS/HSM)
    pubKey, privKey, _ := ed25519.GenerateKey(nil)
    var prevHash [32]byte // 哈希链种子

    // 6. Ring Buffer 轮询消费
    rd, err := ringbuf.NewReader(objs.AuditRb)
    if err != nil {
        log.Fatalf("Ringbuf reader: %v", err)
    }
    defer rd.Close()

    sigChan := make(chan os.Signal, 1)
    signal.Notify(sigChan, syscall.SIGINT, syscall.SIGTERM)

    log.Println("Audit daemon started. Listening for events...")

    for {
        select {
        case <-sigChan:
            log.Println("Shutdown signal received.")
            return
        default:
            record, err := rd.Read()
            if err != nil {
                if ringbuf.IsClosed(err) { return }
                log.Printf("Read error: %v", err)
                continue
            }

            // 7. 解码二进制事件
            evt := parseEvent(record.RawSample)
            
            // 8. 富化: 容器ID映射、K8s元数据注入 (此处省略，对接 CRI/Containerd API)
            // evt.ContainerID = resolveContainerID(evt.Pid)

            // 9. 构建不可篡改日志载荷
            payload := buildLogPayload(evt, prevHash[:])
            
            // 10. 签名
            sig := ed25519.Sign(privKey, payload)
            evt.Signature = base64.StdEncoding.EncodeToString(sig)
            evt.PrevHash = hex.EncodeToString(prevHash[:])
            
            // 11. 更新哈希链
            copy(prevHash[:], payload) // 简化：实际应用 SHA256/SM3(payload)

            // 12. 异步落地 (Kafka/ES/ClickHouse/WORM S3)
            go pushToStorage(evt) // 生产需带重试、背压、批量
        }
    }
}

func parseEvent(data []byte) *AuditEvent {
    // 按 common.h 结构体内存布局解析 (注意字节序、对齐、字符串截断)
    // 此处为伪代码，实际需用 binary.Read 或手动 offset 解析
    return &AuditEvent{}
}

func buildLogPayload(evt *AuditEvent, prevHash []byte) []byte {
    // 序列化为 Canonical JSON 或 Protobuf，包含 prevHash
    data, _ := json.Marshal(evt)
    return data
}

func pushToStorage(evt *AuditEvent) {
    // 对接 Kafka Producer / HTTP Client / SDK
    // 关键：开启幂等写入、ACK=all、事务支持
}

# 1. 内核支持检查
grep -E "BPF_LSM|BPF_SYSCALL|BPF_JIT|BTF" /boot/config-$(uname -r)
# 需 CONFIG_BPF_LSM=y, CONFIG_BPF_SYSCALL=y, CONFIG_DEBUG_INFO_BTF=y

# 2. LSM 挂载顺序检查 (bpf 必须在目标 LSM 之后，如 apparmor)
cat /sys/kernel/security/lsm
# 输出应包含: landlock,lockdown,yama,apparmor,bpf (顺序关键)

# 3. 编译与加载测试
clang -O2 -g -target bpf -D__TARGET_ARCH_x86 -I./headers -c lsm_audit.bpf.c -o lsm_audit.o
bpftool prog load lsm_audit.o /sys/fs/bpf/lsm_audit type lsm
bpftool prog attach pinned /sys/fs/bpf/lsm_audit name lsm_file_open

# 4. 验证事件产出
bpftool map dump pinned /sys/fs/bpf/audit_rb
# 或运行用户态程序观察 JSON 输出

# .gitlab-ci.yml 片段：多内核版本矩阵编译验证
stages:
  - build
  - verify
  - package

variables:
  KERNEL_VERSIONS: "5.15.0-105-generic,6.1.0-1023-azure,5.10.0-27-amd64,4.18.0-513.el8.x86_64" # 覆盖主流发行版

build_bpf:
  stage: build
  image: ghcr.io/cilium/ebpf-builder:latest # 预装 clang, llvm, bpftool, kernel headers
  parallel:
    matrix:
      - KERNEL_RELEASE: ["5.15.0-105-generic", "6.1.0-1023-azure", "5.10.0-27-amd64", "4.18.0-513.el8.x86_64"]
  script:
    - apt-get update && apt-get install -y linux-headers-${KERNEL_RELEASE} linux-image-${KERNEL_RELEASE}-dbgsym # 获取 BTF
    - make KERNEL_RELEASE=${KERNEL_RELEASE} # Makefile 内部调用 bpf2go 生成 _${KERNEL_RELEASE}.go
    - bpftool prog load ./build/lsm_audit_${KERNEL_RELEASE}.o /sys/fs/bpf/test_lsm type lsm --dev-null # 干跑验证 Verifier 通过
  artifacts:
    paths:
      - build/*.o
      - build/*.go
    expire_in: 1 week

verify_btf:
  stage: verify
  needs: [build_bpf]
  script:
    - python3 scripts/verify_btf_compat.py --matrix build/ # 校验关键结构体(task_struct, dentry, inode, file)在所有目标内核布局兼容

// 聚合键：Inode + OpType + PID + UID (区分用户维度)
struct agg_key {
    __u64 inode;
    __u32 op_type;
    __u32 pid;
    __u32 uid;
};

// 聚合值：计数、首次/末次时间戳、错误码位图
struct agg_val {
    __u64 count;
    __u64 first_ts;
    __u64 last_ts;
    __u32 err_bitmap; // BIT(-EPERM) | BIT(-ENOENT) ...
    char comm[MAX_COMM_LEN];
};

struct {
    __uint(type, BPF_MAP_TYPE_PERCPU_HASH);
    __uint(max_entries, 65536);
    __type(key, struct agg_key);
    __type(value, struct agg_val);
} agg_map SEC(".maps");

// 定时器 Map: 触发用户态刷新
struct {
    __uint(type, BPF_MAP_TYPE_TIMER);
    __uint(max_entries, 1);
} flush_timer SEC(".maps");

// LSM Hook 中不再提交 RingBuf，而是更新聚合 Map
SEC("lsm/file_open")
int lsm_file_open_agg(struct file *file, int ret) {
    // ... 白名单、策略匹配同前 ...
    struct agg_key key = { .inode = ino, .op_type = AUDIT_OP_OPEN, .pid = pid, .uid = uid };
    struct agg_val *val = bpf_map_lookup_elem(&agg_map, &key);
    if (val) {
        __sync_fetch_and_add(&val->count, 1);
        val->last_ts = bpf_ktime_get_ns();
        if (ret < 0) val->err_bitmap |= (1 << (-ret));
    } else {
        struct agg_val new_val = { .count = 1, .first_ts = bpf_ktime_get_ns(), .last_ts = bpf_ktime_get_ns(), .err_bitmap = (ret < 0) ? (1 << (-ret)) : 0 };
        bpf_get_current_comm(&new_val.comm, MAX_COMM_LEN);
        bpf_map_update_elem(&agg_map, &key, &new_val, BPF_ANY);
    }
    return 0;
}

// 定时器回调 (Kernel 5.10+ BPF_TIMER)
SEC("timer/flush_agg")
int flush_agg_callback(void *map, int *key) {
    // 遍历 Per-CPU Map，汇总后批量推送 RingBuf
    // 注意：遍历 Per-CPU Map 需 bpf_for_each_map_elem (Kernel 5.12+) 或用户态触发
    return 0;
}

// pkg/enricher/k8s_enricher.go
type K8sEnricher struct {
    client       *kubernetes.Clientset
    crictl       *cri.Client // 或直接解析 containerd/shim socket
    pidCache     *lru.Cache // Key: HostPID, Value: *PodMeta
    mu           sync.RWMutex
}

func (e *K8sEnricher) Enrich(evt *AuditEvent) {
    e.mu.RLock()
    meta, ok := e.pidCache.Get(evt.Pid)
    e.mu.RUnlock()
    if ok {
        evt.K8sMeta = meta
        return
    }
    // 回源查询 (异步更新缓存，不阻塞主流程)
    go e.resolveAndCache(evt.Pid)
}

func (e *K8sEnricher) resolveAndCache(pid uint32) {
    // 1. 读取 /proc/<pid>/cgroup 解析 container_id (kubepods.slice/.../container_id)
    // 2. 通过 CRI ListContainers 过滤 ID 前缀匹配 -> 获取 PodSandboxID
    // 3. 通过 CRI PodSandboxStatus 获取 Pod Name/Namespace/Labels/Annotations
    // 4. 关联 Deployment/StatefulSet/Job (OwnerReferences)
    // 5. 写入 LRU Cache (TTL 5min, 容器销毁自动淘汰)
}

// 富化后的日志样例 (CloudEvents 1.0 规范)
{
  "specversion": "1.0",
  "id": "evt-01HX7K9Z...", // ULID
  "source": "/compliance/audit/ebpf-lsm/node-01",
  "type": "com.example.audit.file.unlink.v1",
  "datacontenttype": "application/json",
  "time": "2024-05-20T10:30:00.123456789Z",
  "subject": "recording_20240520_001.mp4",
  "data": {
    "operation": "DELETE",
    "result": "SUCCESS",
    "actor": {
      "user": "ops_zhangsan",
      "uid": 1001,
      "process": "rm",
      "pid": 12345,
      "container": {
        "id": "cri-containerd-abc123...",
        "name": "recording-cleaner",
        "image": "registry.internal/cleaner:v2.1"
      },
      "k8s": {
        "pod": "recording-cleaner-7d8f9b-xyz",
        "namespace": "meeting-prod",
        "workload": "deployment/recording-cleaner",
        "labels": { "app": "recording", "tier": "batch" }
      }
    },
    "object": {
      "path": "/data/recordings/2024/05/20/recording_20240520_001.mp4",
      "inode": 5242881,
      "size_bytes": 1073741824,
      "permissions": "0640",
      "owner_uid": 1000,
      "owner_gid": 1000,
      "business_tags": { "meeting_id": "M_20240520_001", "retention_level": "L3_3Y" }
    },
    "compliance": {
      "policy_id": "POL-VIDEO-RETENTION-3Y",
      "action": "VIOLATION_DETECTED", // 策略引擎判定：未归档前删除
      "risk_score": 95
    },
    "crypto": {
      "signature": "MEUCIQD...", // Ed25519
      "prev_hash": "a3f2...",    // Hash Chain
      "timestamp_token": "MIAGCSqGSIb3DQEHAqCAMIACAQExDzANBglghkgBZQMEAgEFADC..." // RFC3161 Token
    }
  }
}

// pkg/crypto/gm_crypto.go - 使用 github.com/tjfoc/gmsm
import (
    "github.com/tjfoc/gmsm/sm2"
    "github.com/tjfoc/gmsm/sm3"
    "crypto/elliptic"
)

type GMCrypto struct {
    privKey *sm2.PrivateKey // 存储在 HSM 中，此处仅持有句柄/引用
    hsmClient *hsm.Client   // 对接厂商 PKCS#11 / JCE / REST API
}

func (g *GMCrypto) SignHashChain(payload []byte, prevHash []byte) ([]byte, []byte, error) {
    // 1. 计算 SM3 哈希链
    hasher := sm3.New()
    hasher.Write(payload)
    hasher.Write(prevHash)
    currentHash := hasher.Sum(nil)

    // 2. 签名 (SM2 签名需随机数 K，HSM 内部生成防侧信道)
    // 签名对象：currentHash || payload_len || prevHash_len (防重放/截断)
    toSign := append(currentHash, encodeLengths(len(payload), len(prevHash))...)
    
    sig, err := g.hsmClient.Sm2Sign(toSign) // HSM 返回 r, s (ASN.1 DER 编码)
    if err != nil { return nil, nil, err }
    
    return sig, currentHash, nil
}

func (g *GMCrypto) VerifyChain(logs []*AuditEvent) error {
    var prevHash []byte
    for _, log := range logs {
        // 重构 toSign
        // 验签
        // 校验 currentHash == SM3(payload || prevHash)
        prevHash = log.PrevHash
    }
    return nil
}

# config/policies/video-recording-audit.yaml
apiVersion: compliance.example.com/v1alpha1
kind: AuditPolicy
metadata:
  name: video-recording-protection
  namespace: compliance-system
spec:
  description: "视频会议录制文件核心目录全操作审计，禁止非归档程序删除"
  selector:
    matchPaths:
      - "/data/recordings/**"
      - "/mnt/nfs/recordings/**"
    matchInodes: [] # 可选：精确 Inode 列表 (由 InitContainer 扫描填充)
  rules:
    - operations: ["OPEN", "READ", "WRITE", "UNLINK", "RENAME", "CHMOD", "CHOWN"]
      action: "AUDIT" # 审计
      # 条件表达式 (CEL/Go Template)
      condition: "request.user.uid != 1000 && !request.pod.labels['app'] == 'archiver'" 
    - operations: ["UNLINK", "RENAME"]
      action: "DENY_AND_ALERT" # LSM 返回 -EPERM + 审计 + 告警
      condition: "request.pod.labels['app'] != 'archiver' && request.k8s.workload.kind != 'Job'"
  whitelist:
    - pidPattern: "systemd-*"
    - user: "backup-agent"
    - k8s:
        namespace: "infra"
        labelSelector: "app=backup"
  enrichment:
    - source: "k8s"
    - source: "cmdb" # 关联资产管理系统获取资产等级、责任人
  retention:
    hotDays: 30
    coldYears: 3
    worm: true

// internal/controller/auditpolicy_controller.go
func (r *AuditPolicyReconciler) Reconcile(ctx context.Context, req ctrl.Request) (ctrl.Result, error) {
    var policy compliancev1alpha1.AuditPolicy
    if err := r.Get(ctx, req.NamespacedName, &policy); err != nil {
        return ctrl.Result{}, client.IgnoreNotFound(err)
    }

    // 1. 编译策略 -> eBPF Map 格式 (Inode 列表、位图规则、CEL 表达式字节码)
    compiled, err := r.compiler.Compile(&policy)
    if err != nil {
        r.Recorder.Event(&policy, "Warning", "CompileFailed", err.Error())
        return ctrl.Result{RequeueAfter: time.Minute}, err
    }

    // 2. 下发到各 Node DaemonSet (通过 gRPC/Unix Socket/ConfigMap Watch)
    // DaemonSet 侧 Agent 监听变更，原子性更新 BPF Map (Batch Update)
    if err := r.syncToAgents(ctx, compiled); err != nil {
        return ctrl.Result{RequeueAfter: 10 * time.Second}, err
    }

    // 3. 更新 Status 反馈同步状态
    policy.Status.LastSyncedTime = metav1.Now()
    policy.Status.NodeStatus = r.collectNodeStatus(ctx)
    r.Status().Update(ctx, &policy)
    return ctrl.Result{}, nil
}

graph LR
    A[Prometheus Alert: RingBuf Lost > 0] --> B(Alertmanager)
    B --> C{Webhook -> Auto-Healing Controller}
    C --> D1[扩容 RingBuf Map Sizen(bpftool map update / sysfs)]
    C --> D2[触发 DaemonSet 滚动重启n(加载更大 RingBuf 配置)]
    C --> D3[下发熔断策略n(临时仅审计 WRITE/UNLINK)]
    C --> D4[发送钉钉/企微/OnCall 通知]
    D1 --> E[恢复监控]
    D2 --> E
    D3 --> E
    E --> F[验证 Lost 归零]
    F --> G[自动关闭告警 / 记录复盘单]

compliance-evidence-package/
├── 01_Architecture_Design/
│   ├── System_Architecture.pdf          # 体系架构图、数据流图、信任边界
│   ├── Threat_Modeling_STRIDE.xlsx      # 威胁建模分析表
│   └── Crypto_Design_Spec.md            # 密码学方案选型论证 (SM2/SM3/RFC3161)
├── 02_Implementation_Evidence/
│   ├── eBPF_Source_Code/                # 签名发布的源码包 (Git Tag 对应)
│   ├── SBOM.spdx.json                   # 软件物料清单 (Syft 生成)
│   ├── Cosign_Signatures/               # 镜像/二进制签名验证记录
│   └── Kernel_Version_Compatibility_Matrix.csv # 适配内核版本测试报告
├── 03_Deployment_Operation/
│   ├── Helm_Charts/                     # 部署包 (Values.yaml 脱敏版)
│   ├── GitOps_Repo_Structure/           # 策略 CRD 定义、ArgoCD Application 定义
│   ├── Runbook_Incident_Response.md     # 事件响应手册 (含丢事件、签名失败、存储满处理)
│   └── DR_Drill_Report_2024Q2.pdf       # 灾难恢复演练记录 (RPO/RTO 验证)
├── 04_Audit_Log_Samples/
│   ├── Raw_Event_Samples.jsonl          # 原始事件样本 (脱敏)
│   ├── Enriched_Event_Samples.jsonl     # 富化后语义事件样本
│   ├── Hash_Chain_Verification_Log.txt  # 哈希链完整性自检脚本及输出
│   ├── Signature_Verification_Report.pdf # 批量验签通过报告
│   └── TSA_Token_Verification_Guide.md  # 时间戳令牌验证指引
├── 05_Compliance_Mapping/
│   ├── Equal_Protection_Level3_Mapping.xlsx # 等保三级控制点逐条映射
│   ├── PIPL_Article51_Mapping.xlsx          # 个保法第51条映射
│   └── Industry_Regulation_Mapping.xlsx     # 行业监管 (银监/医监) 映射
└── 06_Red_Blue_Team_Exercise/
    ├── Red_Team_Attack_Log.md           # 红队攻击手法记录
    ├── Blue_Team_Detection_Report.pdf   # 蓝队检测响应复盘
    └── Remediation_Plan_Tracking.xlsx   # 整改计划跟踪表