JAILER

Summary from the TLDR InfoSec newsletter

An eBPF-based mandatory access control system for Linux that enforces role-based policies on file access, network operations, and process execution using BPF LSM hooks and task_storage maps. Processes enroll via Unix socket or auto-enrollment triggers (executable path, cgroup, or xattr), with jail policies inherited by child processes. Two deployment modes are supported: a daemon mode with hot policy reload and a daemonless mode that pins BPF programs during early boot to reduce the attack surface.