// KERNEL_SECURITY · LINUX_SECURITY_MODULE
AEGIS
Advanced Guardian for Integrated System Security — a stackable Linux Security Module adding process protection, file integrity, syscall auditing and kernel module control to the Linux kernel.
GPL-2.0
LINUX 7.3-RC1
C ~2000 LINES
X86_64
QEMU-TESTED
CI
Built against upstream torvalds/linux · feature-flagged layers · in-tree upstream patches · bootable end-to-end in QEMU with a one-command reproduce script.
CAPABILITIES
PROCESS_PROTECTGuard processes against ptrace and interference from untrusted contexts; per-profile enforcement on exec.
FILE_INTEGRITYPath-, inode- and profile-gated integrity checks over executable and sensitive files.
SYSCALL_AUDITAttributable auditing of security-relevant syscalls with granular allow-list layering.
KERNEL_MODULE_CTRLGate module load/unload and firmware paths — feature-flagged, min config surface by design.
LAYERED_ACHITECTURESmall models; dangerous operations pushed to userspace supervisors; kernel kept minimal.
UPSTREAM_PATHPatches structured for the upstream security/ tree; devkit initramfs for a reproducible dev OS.
BUILD
# userspace devkit (aegisctl + initramfs)
$ cd devkit && make -j"$(nproc)" initramfs
$ file devkit/build/aegisctl
# in-tree module build runs in CI (fetches torvalds/linux, applies patches)
$ # configuration: build/aegis.config → CONFIG_SECURITY_AEGIS=y