A Linux kernel security module (LSM) — enforcing security policy in kernel space, at the syscall boundary, before damage is done instead of after detection.
git clone https://github.com/Hartwell-Labs/linux-aegisEvery capability below ships in the open-source core — MIT licensed, CI on every push.
Implements the Linux Security Module interface — hooks into the kernel's security decision points, not a side-channel daemon.
Policy is enforced where the attacks actually happen: at the syscall boundary, with no race between detection and response.
Explicit allow/deny decisions per operation — containment that does not depend on the attacked process cooperating.
Pairs naturally with behavioral monitors like talus: they observe, aegis enforces.
A focused C codebase meant to be read line by line — kernel code earns trust by being reviewable.
MIT licensed and built in the open, with CI on every push.