Kernel Borderlands 1.0.0

Kernel Borderlands 1.0.0

First release. Kernel-level runtime defense for Linux: eBPF sensors observe at Ring 0, a Go control plane scores and enforces, operator interfaces (kbctl, dashboard, SSH console) sit on top.

Install

Distro	Package
Ubuntu 24.04 / Debian	sudo apt install ./kernel-borderlands_1.0.0_amd64.deb
Arch	sudo pacman -U kernel-borderlands-1.0.0-1-x86_64.pkg.tar.zst

Nothing starts on install. Run sudo kbctl up, then kbctl dashboard open. Verify downloads against SHA256SUMS. The field manuals (KB-Field-Manual-*.pdf) cover install, operation and the CLI reference.

Requirements: Linux with BTF, bpf in the LSM list (see docs/architecture/enabling-bpf-lsm.md), systemd, openssh. kb-checker ships but is kept down (under maintenance); kbctl up does not start it.

What changed since the 0.1.0 pre-release

• TERMINATE really kills, behind CPM and CWP. kbd sends SIGKILL (through a pidfd) only after its own CPM/CWP check passes and the sensor reports that it applied level 4. PID 1, kernel threads, protected executables and registered workloads are never killed.
• Sensor reports its CPM/CWP decision back to kbd (new wire message CONTAINMENT_ACK, msg_type 10; additive, wire version unchanged). Every refusal is audited as CONTAINMENT_REFUSED_BY_SENSOR.
• Dashboard: Kill is separate from Isolate. Isolate is reversible namespace-level containment; Kill (POST /api/kill, two-click confirmation) terminates.
• Sensor protected-executable list now covers the packaged install paths (/usr/bin, /usr/sbin).
• Containment routes report failures instead of always answering success.

Known limits

• A sensor from before this release never acknowledges containment commands, so TERMINATE is refused until the sensor is upgraded together with kbd. Upgrade both from the same package.
• The end-to-end kill path (real sensor, real ack, real SIGKILL) has unit and compile coverage but has not been exercised on a live host.
• kb-checker is under maintenance and not started by default. kbagents (Python swarm) is installed but not enabled.
• Binaries link the build host's glibc: the .deb was built on Ubuntu 24.04 (glibc 2.39), the Arch package on Arch.

Full history: CHANGELOG.md.

0.1.0 (pre-release): packages and field manuals

Pre-release of the Kernel Borderlands packages and field manuals. Packages built from commit ff3a024; field manuals rebuilt at 450ff3e (adds the install-to-uninstall demonstration runbook).

File	What
kernel-borderlands_0.1.0_amd64.deb	Ubuntu 24.04 package, built on Ubuntu 24.04 (glibc 2.39)
kernel-borderlands-0.1.0-1-x86_64.pkg.tar.zst	Arch Linux package, built on Arch
KB-Field-Manual-Ubuntu.pdf, KB-Field-Manual-Arch.pdf	The Kernel Borderlands field manual, one per distro (127 pages)
SHA256SUMS	sha256sum -c SHA256SUMS

Tested: the .deb on an Ubuntu 24.04 VM with root, 34/34 checks (packaging/vm-test/kbinstaller.sh): install and legacy migration, dashboard API token and CORS, services on the packaged units with kb-checker left dead, SSH operator console with a live link to kbd, audit chain, sensor under the package.

Not tested: installing the Arch package (pacman -U), kbagents under systemd, reboot persistence, clicking isolate/restore in a browser against a live kbd.

Notes: kb-checker is under maintenance and repairs and stays down unless started by hand. Members of group kb have full control-plane access over /run/kb/kba.sock. The dist/ folder in the repository holds an older build without the sshd/account/socket fixes; use these release assets instead.