fdir#

Integrity monitoring for kernel isolation structures.

Periodic integrity checker that takes known-good snapshots of kernel isolation structures (page tables, seccomp filters, cgroup configs, memory mappings) at boot and detects radiation-induced corruption by comparing against them on a configurable timer. Designed for space-grade Linux systems where single-event upsets can silently corrupt kernel state.

The library hashes /proc/self/maps, /proc/self/status, and /proc/self/cgroup using SHA-256 and runs as an Eio daemon fiber that periodically re-checks against the baseline. Anomalies are classified by severity (Log, Isolate, Restart, Degrade, Safe_mode) based on how many subsystems have diverged.

Installation#

opam install fdir

Usage#

Eio_main.run @@ fun env ->
Eio.Switch.run @@ fun sw ->
let clock = Eio.Stdenv.clock env in
let fs = Fdir.Procfs.live () in
let baseline = Fdir.snapshot ~clock fs in
let config = Fdir.Config.v ~interval:30.0 () in
Fdir.start_daemon ~sw ~clock ~config ~baseline ~fs
  ~on_anomaly:Fdir.default_handler ()

API#

• Procfs -- Data source abstraction. Procfs.live () reads from real /proc; Procfs.mock provides canned data for testing.
• snapshot -- Takes a SHA-256 snapshot of all monitored subsystems.
• check -- Compares current state against a baseline snapshot, returning Ok or Anomaly with a list of divergent subsystems.
• Config -- Configures the check interval (default 30s) and which subsystems to monitor (Memory_maps, Seccomp, Cgroups).
• start_daemon -- Forks an Eio daemon fiber that runs periodic checks and invokes a handler on anomalies.
• default_handler -- Returns Log for 1 anomaly, Degrade for 2, and Safe_mode for 3+.