cirven systems / modules / cage

cirven cage

Every program you run can read your whole home directory: your ssh keys, your browser profile, your cloud credentials. AI coding agents make this worse. They run commands, and a prompt injection hidden in a README is enough to steer them. cage gives a process the project it works on and nothing else.

usage

$ cirven cage -p agent -- claude
cage: profile agent · write . ~/.claude ~/.cache ... · net on
$ cirven cage -- cat ~/.ssh/config
cat: /home/u/.ssh/config: Permission denied
$ cirven cage --no-net -- makepkg
$ cirven cage --read ~/.gitconfig --write ./out -- ./build.sh
$ cirven cage --list

how

• landlock: the system read-only, the current directory writable, home out of reach. no root needed, inherited by every child
• no network: a private user and network namespace with nothing but a downed loopback. no tcp, no udp, no dns
• no_new_privs: sudo and setuid binaries cannot raise privileges inside the cage
• refuses to run when the kernel cannot enforce landlock, instead of pretending
• profiles: built-in default, offline, agent, or plain text files in ~/.config/cirven/cage/

# ~/.config/cirven/cage/build.profile
include offline
read  ~/.gitconfig
write ./out

planned: per-host egress allowlists, seccomp filters.

threat model

Stops: a confused or hijacked tool reading or sending what it should not. Does not stop: kernel exploits that escape the sandbox, data you explicitly allow, or exfiltration over the network while it is on: use --no-net where you can.