owLSM

🛡️ owLSM aspires to become the gold standard for prevention and detection for Linux 🛡️ owLSM is an eBPF LSM agent that implements a stateful Sigma rules engine focused on prevention. What is the project: owLSM focuses on three main things: 1 Prevention capabilities using a Sigma Rules Engine...

lockc

lockc is open source sofware for providing MAC Mandatory Access Control type of security audit for container workloads. The main reason why lockc exists is that containers do not contain. Containers are not as secure and isolated as VMs. By default, they expose a lot of information about host OS...

block-copyfail

Summary CVE-2026-31431 "Copy Fail" is a Linux kernel privilege escalation vulnerability in the algifaead cryptographic interface. An attacker uses AFALG sockets with the authencesn algorithm and splice to corrupt arbitrary files in the kernel page cache — including setuid binaries like /usr/bin/s...

deny-af-alg-bpf

deny-af-alg-bpf Description BPF LSM program that blocks AFALG Linux kernel crypto API socket creation and logs all attempts via a ring buffer to userspace. What it does Attaches to the lsm/socketcreate hook Denies any socketAFALG, ... call with -EPERM Emits structured events pid, comm to a BPF ri...

lsm_bpf_check_argc0

Check ARGC0 LSM BPF Simple LSM BPF program to prevent program executions with argc == 0, e.g. pwnkit CVE-2021-4034. It does nothing more than a simple check that all exec system calls are called with argc = 1. The check is based on Ariadne Conill's patch. How to build On Ubuntu $ sudo apt-get...

copy-fail-blocker

copy-fail-blocker BPF-LSM mitigation for CVE-2026-31431 "Copy Fail" and the RxRPC variant of Dirty Frag, and for similar privilege-escalation vulnerabilities that depend on userspace access to a kernel-side in-place crypto path reachable via the AFALG or AFRXRPC socket families. A small DaemonSet...

kprotect

🛡️ kprotect Overview kprotect is a kernel-level security engine designed to protect your sensitive data from supply-chain attacks like malicious Python or Node.js libraries. It stands as an independent security layer for the most sensitive files. eBPF-LSM Enforcement : Intercepts file access at th...

LID

██╗ ██╗██████╗ ██║ ██║██╔══██╗ ██║ ██║██║ ██║ ██║ ██║██║ ██║ ███████╗██║██████╔╝ ╚══════╝╚═╝╚═════╝ Linux Integrity Drift — "Linux is Dying" — Systematic discovery of kernel code paths that bypass LSM security guarantees The gate was never breached. It was walked around. What is LID? The Linux...

bombini

Bombini: eBPF-based Security Monitoring and Sandboxing Agent Bombini is an eBPF-based security agent written entirely in Rust using the Aya library and built on LSM Linux Security Module BPF hooks. At its core, Bombini employs modular components called Detectors, each responsible for monitoring a...

bpfjailer

BpfJailer eBPF based Mandatory Access Control for Linux. This project is a full rewrite of the closed source BpfJailer and is completely experimental. It leverages newer features like bpf arena that were not available when the internal BpfJailer was written. Issues are expected and are not eligib...

cplt

cplt Kernel-enforced sandbox for AI coding agents. cplt wraps GitHub Copilot CLI, OpenCode, Gemini CLI, Antigravity CLI, Pi, Claude Code, goose, DeepSeek Harness, or any shell, so the agent can write code but cannot steal credentials, push to main, merge PRs, or exfiltrate secrets. macOS : Apple...

agent

Bomfather Agent Bomfather Agent is an eBPF-based agent that runs in the kernel space to block actions based on a policy. We built this agent to solve the problems we had with existing solutions. 1. They were too complex to set up and use. 2. They were too slow and inefficient. 3. And even if they...

hardstop

Hard Stop: Kernel-Level Preemption and Containment for Rogue Agentic Execution Architectural Comparison: Off-Board Hardware Fabrics DPUs / SmartNICs vs. In-Cache Kernel Preemption Hard Stop Off-board hardware security architectures route agent execution telemetry out-of-band across host I/O buses...

KubeArmor

KubeArmor es un sistema de aplicación de seguridad en tiempo de ejecución nativo de la nube que restringe el comportamiento como la ejecución de procesos, el acceso a archivos y las operaciones de red de pods, contenedores y nodos VM...

block-copyfail

block-copyfail Prova di concetto di mitigazione runtime per CVE-2026-31431 "Copy Fail" — un'escalation di privilegi nel kernel Linux tramite il template crittografico authencesn in algifaead. A differenza del blacklisting dei moduli, questo non richiede riavvio. Un programma BPF LSM aggancia...

Astra Linux – Vulnerability found in Linux 6.1, Linux 5.15

In the Linux kernel, the following vulnerabilities have been resolved: - bpf: The functions taskto inode and inetconnestablished have been removed from the sleepable LSM hooks. bpflsmtaskto inode is called under rcureadlock, and bpflsminetconnestablished is called from a softirq context. Therefor...

Rocky Linux 10.0 [CIQ] Security Update: kernel / kernel-64k / kernel-64k-core / kernel-64k-debug / etc Multiple Vulnerabilities (crlsa-2025_16904)

The Rocky Linux 10.0 host has packages installed that are affected by multiple vulnerabilities as referenced in the CIQ crlsa-202516904 advisory. kernel: fs: export anoninodemakesecureinode and fix secretmem LSM bypass CVE-2025-38396 kernel: smb: client: fix use-after-free in cifsoplockbreak...

ContractWarden: Kernel-Enforced Damage Boundaries for AI Agents Via Human-Authorized Contracts

Large language model agents can execute commands, create subprocesses, and directly access files and networks, allowing prompt injection or planning errors to become operating-system side effects. We present ContractWarden, a Linux reference monitor that enforces a human-authorized damage boundar...

SUSE CVE-2026-93173

In the Linux kernel, the following vulnerability has been resolved: bpf,lsm: Drop bpfprogfree from sleepablelsmhooks bpfprogputrcu is the callrcu callback for non-sleepable programs. securitybpfprogfree called from there fires bpfprogfree in softirq; if a sleepable LSM prog is attached to that...

KubeArmor v1.7.6-rc1

KubeArmor is a cloud-native runtime security enforcement system that restricts the behavior such as process execution, file access, and networking operations of pods, containers, and nodes VMs at the system level. KubeArmor leverag...