Skip to content

Kernel Borderlands 1.0.0

Latest
Latest

Choose a tag to compare

View all tags
@pardhuvarmax pardhuvarmax released this 27 Oct 21:25
v1.0.0
cf0a16d

Kernel Borderlands 1.0.0

First release. Kernel-level runtime defense for Linux: eBPF sensors observe at Ring 0, a Go control plane scores and enforces, operator interfaces (kbctl, dashboard, SSH console) sit on top.

Install

Distro Package
Ubuntu 24.04 / Debian sudo apt install ./kernel-borderlands_1.0.0_amd64.deb
Arch sudo pacman -U kernel-borderlands-1.0.0-1-x86_64.pkg.tar.zst

Nothing starts on install. Run sudo kbctl up, then kbctl dashboard open. Verify downloads against SHA256SUMS. The field manuals (KB-Field-Manual-*.pdf) cover install, operation and the CLI reference.

Requirements: Linux with BTF, bpf in the LSM list (see docs/architecture/enabling-bpf-lsm.md), systemd, openssh. kb-checker ships but is kept down (under maintenance); kbctl up does not start it.

What changed since the 0.1.0 pre-release

  • TERMINATE really kills, behind CPM and CWP. kbd sends SIGKILL (through a pidfd) only after its own CPM/CWP check passes and the sensor reports that it applied level 4. PID 1, kernel threads, protected executables and registered workloads are never killed.
  • Sensor reports its CPM/CWP decision back to kbd (new wire message CONTAINMENT_ACK, msg_type 10; additive, wire version unchanged). Every refusal is audited as CONTAINMENT_REFUSED_BY_SENSOR.
  • Dashboard: Kill is separate from Isolate. Isolate is reversible namespace-level containment; Kill (POST /api/kill, two-click confirmation) terminates.
  • Sensor protected-executable list now covers the packaged install paths (/usr/bin, /usr/sbin).
  • Containment routes report failures instead of always answering success.

Known limits

  • A sensor from before this release never acknowledges containment commands, so TERMINATE is refused until the sensor is upgraded together with kbd. Upgrade both from the same package.
  • The end-to-end kill path (real sensor, real ack, real SIGKILL) has unit and compile coverage but has not been exercised on a live host.
  • kb-checker is under maintenance and not started by default. kbagents (Python swarm) is installed but not enabled.
  • Binaries link the build host's glibc: the .deb was built on Ubuntu 24.04 (glibc 2.39), the Arch package on Arch.

Full history: CHANGELOG.md.

Assets 7
Loading