bpf-lsm

Confine an AI coding agent to one directory with a BPF-LSM program, and watch every escape it tries.

Deterministic Linux runtime enforcement with eBPF LSM: block file/network operations before syscalls complete.

KernelSeal makes secrets unstealable. It removes secrets from filesystems and environment variables and enforces kernel-level protection so that even root in a compromised container cannot extract them.

Kernel-enforced sandboxing for untrusted processes. Two zero-dependency core tools, one shared profile format, plus an optional BPF-LSM module.

SELinux, IdM, and AAP proof of concept for confining privileged automation and denying kernel exploit surfaces before jobs reach managed RHEL hosts.

A modular Next-Generation Antivirus (NGAV) and Endpoint Detection & Response (EDR) for Linux, leveraging eBPF (LSM) and Rust for memory-safe userland.

Object-first file access control for Linux: make ~/.ssh, ~/.aws and other secrets readable only by the tools that own them. Enforced in-kernel with eBPF (BPF-LSM), in Rust. Early development.

Kernel-aware agent governance daemon. Tamper-evident hash-chained audit ledger, BPF-LSM enforcement, Z3-backed policy checks. Research prototype.