Linux

Governing an AI agent with another AI firewall creates the Quis Custodiet paradox: both systems are probabilistic and subject to prompt injection and data poisoning. The kernel has no concept of intent — it enforces access control via EPERM regardless of what the agent claims. Container isolation (namespace + cgroup), strict RBAC, stripped Linux capabilities, and SELinux/AppArmor MAC profiles provide deterministic guarantees that semantic AI parsing cannot. Agents with no .env file read permission cannot exfiltrate .env files, regardless of how they’re prompted.

Every HTTP server abstraction collapses to the same syscall chain: socket → bind → listen → accept → read → sendfile → close. In pure x86_64 Assembly, each step is explicit: bswap converts port to network byte order, SCASB/LODSB scans the GET request path byte-by-byte for ../ traversal sequences, sys_fstat retrieves exact file size for sys_sendfile, sys_sendfile(40) transfers file data directly from disk to NIC via kernel space — zero user-space copy, zero libc, zero external libraries. Full source on GitHub.

Traditional /tmp files leave disk traces and inode artifacts. memfd_create (Linux 3.17+, syscall 319) allocates anonymous files backed exclusively by RAM-resident tmpfs — invisible to directory listings, destroyed on fd close, and undetectable by standard forensic imaging. x64 Assembly implementation: null-terminated name label visible only in /proc/pid/fd/, MFD_CLOEXEC flag, fd sealing via fcntl. Blue Team surface: eBPF sys_memfd_create hooks and /proc/pid/fd/ memfd: link auditing.