plugin-bpf

Placement	runtime (out-of-process over gRPC)
Source	github.com/opencharly/plugin-bpf/candy/plugin-bpf
Version	2026.243.0001
Candy	plugin-bpf

This plugin is not listed in charly/charly.yml’s compiled_plugins:. It is not part of the shipped binary: charly builds and loads it out-of-process over gRPC when a plan references one of its words (the coexist path).

Providers

The reserved words this plugin serves:

• bpf — command class
• bpf — verb class

What it does

OUT-OF-TREE GENERIC charly BPF/eBPF kernel plugin — the one canonical surface for BPF kernel-feature readiness on any venue (bare host or VM guest): command:bpf (status | lsm | config | probe) plus the verb:bpf declarative check steps any candy can bake into its plan. Reads the kernel state directly and READ-ONLY: /sys/kernel/security/lsm (the BPF-LSM gate cardwire-class tools need), /sys/kernel/btf/vmlinux, CONFIG_BPF_LSM/CONFIG_DEBUG_INFO_BTF, the BPF sysctl knobs, memlock and lockdown. Read-only by default; probe is a verify-only attach-requirements report (a real transient attach probe requires an explicit –attach flag + root + bpftool). Dual-class (plugin-mcp precedent): command:bpf is CLI-dispatched (charly fork/execs the binary), verb:bpf is served over gRPC with a self-contained #BpfInput schema. First consumer: plugin-cardwire’s status gates on the same BPF-LSM facts (R3: one canonical surface, no ad-hoc copies).

Parameter schema

The CUE schema below is the authoritative grammar for this plugin’s input. It is the same single source that generates the plugin’s Go parameter types and answers the runtime Describe RPC, so this page cannot disagree with either.

schema/bpf.cue

// The `bpf` plugin's OWN CUE schema — the typed plugin_input for the `bpf`
// BPF-readiness check verb. It is the SINGLE SOURCE for this plugin's params,
// used two ways:
//
//  1. GENERATE the Go param struct — `cue exp gengotypes` (driven by the cue:gen
//     pipeline, which wraps this with `package params` + `@go(params)`) emits
//     ../params/cue_types_gen.go, so the provider decodes plugin_input into a
//     TYPED struct, never a hand-parsed map.
//  2. VALIDATE authored input AT RUNTIME — the plugin serves this source over the
//     Describe channel; the host splices it onto the base (base ++ plugin) and
//     validates every authored `bpf:` step's plugin_input against #BpfInput.
//
// SELF-CONTAINED: it references NO base def, so it compiles standalone
// (gengotypes + the load-gate compile) AND splices onto the base (base ++ plugin
// is a def-name collision check, not a base-reference resolver).
#BpfInput: {
  // lsm — the scalar-sugar primary: assert bpf is in the active LSM list.
  // The step's own matchers decide pass/fail (e.g. stdout contains "enabled",
  // or exit_status 0).
  lsm?: bool @go(Lsm)

  // status — matcher form over the readiness facts.
  status?: {
    // lsm_bpf — is bpf in the active LSM list.
    lsm_bpf?: bool @go(LSMHasBPF)
    // btf_present — does /sys/kernel/btf/vmlinux exist.
    btf_present?: bool @go(BTFPresent)
    // config_bpf_lsm — is CONFIG_BPF_LSM=y.
    config_bpf_lsm?: bool @go(ConfigBPFLSM)
  }
}

---

See also the candy reference for this candy’s install surface.