release: v0.9.0 — file deletions (FileDelete via unlinkat)

sys_enter_unlinkat -> AgentEvent::FileDelete {pid, path} (opt-in A3S_OBSERVER_FILES),
completing the file lifecycle (write + delete) — destructive actions now visible (rm -rf shows
which files went). Host-validated: deleting a marker -> FileDelete{path}. Shares the file ring
via a flags sentinel (no extra ring/struct). 0.8.0 -> 0.9.0.

Author: RoyLin

CHANGELOG.md

@@ -2,6 +2,16 @@
 
 All notable changes to a3s-observer will be documented in this file.
 
+## [0.9.0] — file deletions (destructive actions)
+
+### Added
+
+- **`FileDelete` event** — `sys_enter_unlinkat` captures which files an agent **deletes**
+  (opt-in with `A3S_OBSERVER_FILES=1`), completing the file lifecycle (write + delete). You now
+  see destructive actions: `rm -rf /data` shows *which* files went, not just that `rm` ran.
+  Host-validated: deleting a marker file surfaced `FileDelete{path:…}`. Shares the file ring via
+  a `flags` sentinel (no extra ring/struct).
+
 ## [0.8.0] — process lifecycle (exit + exit code)
 
 ### Added

Cargo.lock

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2021"
 license = "MIT"
 description = "General-purpose, language-agnostic eBPF observability for AI agents (LLM calls, tools, files, network egress)."

Cargo.toml

@@ -50,6 +50,7 @@ latency / TTFT, or plaintext) / **where** (peer IP / hostname).
 | `dns` | `sendto` / `sendmsg` / `sendmmsg` to :53 | `Dns` — resolved hostname |
 | llm metrics | per-socket `read`/`recv` + `close` | `LlmCall` — req/resp wire bytes, latency, TTFT |
 | `file`\* | `sys_enter_openat` (write opens) | `FileAccess` — files written (`A3S_OBSERVER_FILES=1`) |
+| `unlink`\* | `sys_enter_unlinkat` | `FileDelete` — files deleted (`A3S_OBSERVER_FILES=1`) |
 | `ssl`\* | OpenSSL `SSL_write` / `SSL_read` uprobes | `SslContent` — request/response plaintext (`A3S_OBSERVER_SSL=1`) |
 
 Userspace enriches each event with **identity** (k8s cgroup→pod, `/proc` comm+ppid, or an

README.md

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-collector"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2021"
 license = "MIT"
 description = "a3s-observer collector: loads the eBPF probes and exports enriched events."

a3s-observer-collector/Cargo.toml

@@ -12,6 +12,7 @@ use a3s_observer::{
 };
 use a3s_observer_common::{
     ConnectEvent, DnsEvent, ExecEvent, ExitEvent, FileEvent, LlmEvent, SslEvent, TlsEvent,
+    FILE_DELETE_FLAG,
 };
 use anyhow::Context as _;
 use aya::{
@@ -72,6 +73,7 @@ async fn main() -> anyhow::Result<()> {
     ];
     if files {
         probes.push(("file_open", "sys_enter_openat"));
+        probes.push(("file_unlink", "sys_enter_unlinkat"));
     }
     // Per-probe attach is non-fatal: kernels vary, and one missing tracepoint shouldn't take
     // down the whole collector — degrade to whatever attaches, fail only if nothing does.
@@ -305,14 +307,20 @@ async fn main() -> anyhow::Result<()> {
                     if let Some(ev) = read_pod::<FileEvent>(&item) {
                         let path = cstr(&ev.path);
                         if !path.is_empty() {
-                            emit(exporter.as_ref(), &mut stats, EnrichedEvent {
-                                identity: identity_for(&resolver, ev.pid, &ev.comm),
-                                provider: None,
-                                event: AgentEvent::FileAccess {
+                            // Same ring carries opens and deletes — the sentinel flag tells them apart.
+                            let event = if ev.flags == FILE_DELETE_FLAG {
+                                AgentEvent::FileDelete { pid: ev.pid, path }
+                            } else {
+                                AgentEvent::FileAccess {
                                     pid: ev.pid,
                                     path,
                                     write: ev.flags & 0x3 != 0,
-                                },
+                                }
+                            };
+                            emit(exporter.as_ref(), &mut stats, EnrichedEvent {
+                                identity: identity_for(&resolver, ev.pid, &ev.comm),
+                                provider: None,
+                                event,
                             });
                         }
                     }
@@ -467,6 +475,7 @@ fn emit(exporter: &dyn Exporter, stats: &mut Stats, ev: EnrichedEvent) {
         AgentEvent::Egress { .. } => stats.egress += 1,
         AgentEvent::Dns { .. } => stats.dns += 1,
         AgentEvent::FileAccess { .. } => stats.file += 1,
+        AgentEvent::FileDelete { .. } => stats.file += 1,
         AgentEvent::LlmCall { .. } => stats.llm += 1,
         AgentEvent::SslContent { .. } => stats.ssl += 1,
     }

a3s-observer-collector/src/main.rs

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-common"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2021"
 license = "MIT"
 description = "Shared no_std types crossing the eBPF <-> userspace boundary for a3s-observer."

a3s-observer-common/Cargo.toml

@@ -93,6 +93,10 @@ pub struct FileEvent {
     pub path: [u8; PATH_SNAP_LEN],
 }
 
+/// `FileEvent.flags` sentinel marking a deletion (`unlinkat`) rather than an open — no real
+/// `openat` flag combination equals `u32::MAX`, so userspace can tell them apart on one ring.
+pub const FILE_DELETE_FLAG: u32 = u32::MAX;
+
 /// Metrics for one LLM call, emitted when its TLS socket closes. Bytes/timing are
 /// accumulated in-kernel per `(pid,fd)`; userspace joins this with the SNI/provider/peer it
 /// recorded at ClientHello time to build the full `LlmCall`.

a3s-observer-common/src/lib.rs

@@ -1,6 +1,6 @@
 [package]
 name = "a3s-observer-ebpf"
-version = "0.8.0"
+version = "0.9.0"
 edition = "2021"
 license = "MIT"
 publish = false

a3s-observer-ebpf/Cargo.toml

@@ -3,7 +3,7 @@
 
 use a3s_observer_common::{
     ConnectEvent, DnsEvent, ExecEvent, ExitEvent, FileEvent, LlmEvent, SslEvent, TlsEvent,
-    ARGV_SLOTS, ARG_LEN, DNS_SNAP_LEN, PATH_SNAP_LEN, SSL_SNAP_LEN, TLS_SNAP_LEN,
+    ARGV_SLOTS, ARG_LEN, DNS_SNAP_LEN, FILE_DELETE_FLAG, PATH_SNAP_LEN, SSL_SNAP_LEN, TLS_SNAP_LEN,
 };
 use aya_ebpf::{
     helpers::gen::bpf_probe_read_user,
@@ -525,6 +525,30 @@ fn try_open(ctx: &TracePointContext) -> Result<u32, i64> {
     Ok(0)
 }
 
+// ---- file deleted (sys_enter_unlinkat) — the "which files did the agent destroy" signal ----
+
+#[tracepoint]
+pub fn file_unlink(ctx: TracePointContext) -> u32 {
+    try_unlink(&ctx).unwrap_or(0)
+}
+
+fn try_unlink(ctx: &TracePointContext) -> Result<u32, i64> {
+    // sys_enter_unlinkat: dfd @16, pathname @24, flag @32.
+    let pathname: *const u8 = unsafe { ctx.read_at(24)? };
+    let Some(mut entry) = reserve_or_drop::<FileEvent>(&FILE_EVENTS) else {
+        return Ok(0);
+    };
+    let ev = entry.as_mut_ptr();
+    unsafe {
+        (*ev).pid = (bpf_get_current_pid_tgid() >> 32) as u32;
+        (*ev).flags = FILE_DELETE_FLAG; // distinguish from an openat on the shared FILE_EVENTS ring
+        (*ev).path = [0u8; PATH_SNAP_LEN];
+        let _ = bpf_probe_read_user_str_bytes(pathname, &mut (*ev).path);
+    }
+    entry.submit(0);
+    Ok(0)
+}
+
 // ---- LLM-call metrics: response bytes + TTFT (read/recv enter+exit), flush on close ----
 // Response side needs the byte count, which is the syscall *return* value (exit), but the
 // fd is only on enter — so enter stashes the fd (for tracked sockets only) and exit reads it.