Kernel Assurance Plane (KAP) adds an objective-scoped authority context as a
kernel object. An Intent Lineage Group (igroup) is that object: an externally
managed authority whose lifetime is tied to an objective rather than to a
process, a thread group or a sandbox, that a trusted controller can update or
revoke in place while unmodified worker tasks keep running.
v1 [1] was the design document. v2 added the implementation and moved the
control plane under securityfs. This version answers the v2 review.
The review asked, in several forms, why this needs a new LSM rather than
Landlock or a BPF LSM. The short answer, now the spine of the design document,
is that path and syscall mediation is not the distinction: Landlock and seccomp
already do that, often better. What they do not provide is an authority context
that an outside controller can narrow or revoke, per objective, for a task that
is already running, while a second objective beside it is untouched. The
document opens with that and gives a two-objective example.
Changes since v2:
* Design document (1/6) reworked to answer the review:
- leads with the authority-lifecycle distinction and the two-objective
example, and states plainly that the mediation overlaps Landlock;
- raises the central question (question 1): should KAP be a minimal
authority-lifecycle facility that composes with Landlock and existing hooks
for enforcement, rather than a self-contained LSM with its own mediation;
- drops the incorrect "cgroup membership cannot follow setns" claim and
reframes the cgroup and BPF-LSM rationales around which lifecycle semantics
should be a shared contract, not which mechanism enforces;
- states the JSON subset is a prototype wire form, not the model;
- narrows the net (connect only), ipc (coarse Unix, no SysV confinement),
descriptor (file_receive only), procfs and io_uring claims to what is
implemented;
- adds the deployment and privilege model and the lineage-root trust
boundary (opaque, not kernel-verified in this version);
- reframes question 5 to prefer existing namespace-transition hooks where
the target tree has them.
* Code (4/6): the only code change is removing an unused securityfs dentry that
the kernel test robot flagged (-Wunused-but-set-global). The code is otherwise
identical to v2.
The prototype runs as the guest kernel of Kata microVMs (Linux 6.18) and of
Docker Sandboxes (Linux 7.0). In a Kata guest under nested virtualization,
running the same binary unbound and then bound, enforcement adds 154 ns to a
read and 787 ns to an open, while the unhooked getpid control does not move. On
Docker Sandboxes, allow, deny and revoke were exercised on a real agent.
Known gaps, where feedback is welcome:
* Whether KAP should keep its own mediation or compose with Landlock and
existing hooks is open and is question 1; the current series is the
self-contained form.
* The authority wire form is a strict subset of JSON and is experimental.
* Decisions are serialized by one spinlock, and those that resolve a path
allocate a PATH_MAX buffer before taking it. Both are prototype choices.
* igroups cannot be removed yet, and kap.procs keeps the pids written to it
after those tasks exit. A task's binding lives in its task blob and is
released with it.
* A thread created while its process is being bound can miss the binding.
cgroups closes the same race with cgroup_threadgroup_rwsem; KAP does not yet.
* Control writes need CAP_SYS_ADMIN. CAP_MAC_ADMIN may be the better fit.
* unshare and setns call KAP directly because they have no LSM hook in this
base (question 5 in the document).
* There are no selftests in this series yet. It was built with and without KAP
and with networking, namespaces and io_uring disabled, and boot tested in
QEMU with lock debugging: the control plane, file and exec decisions, epoch
revocation of a running task and kap.default.
* The LSM ID is provisional and is for the LSM maintainers to confirm.
[1] https://lore.kernel.org/linux-security-module/20261021165748.19304-1-ketan@armoriq.io/ (local)
Base commit: 24a19b953e2a3d0ea5a8c4951a0ab8f32720c907 (Linux 7.3-rc7)