PaperlayerView exact revision on arXiv

Source-linked AI summary

ContractWarden: Kernel-Enforced Damage Boundaries for AI Agents via Human-Authorized Contracts

Dongxu Cui, Zhichao Gu, Ping Zheng, Wenshuai Xi, Simeng Han, Yong Liao

arXiv:2609.38248v1cs.CRcs.OS

TL;DR

LLM agents can turn prompt injection or planning errors into system effects, motivating enforcement beyond application-layer validation. ContractWarden binds a human-authorized asset contract to a task before execution and enforces it in the kernel. All 570 security observations pass, and co-located tests report lower overhead than frozen ActPlane on both evaluated platforms.

  • Problem

    LLM agents can execute commands and access files and networks, while application-layer validation is insufficient when accepted tool calls expand into subprocesses and direct system calls.

    Source: §I · p. 1

  • Method

    ContractWarden has a model propose an asset contract for human confirmation, binds the validated policy to a task before execution, and enforces and propagates state through supported kernel paths.

    Source: §I · p. 1

  • Results

    11.96–12.89% overhead in the eight-vCPU VMware guest and 35.79–61.54% on the 32-thread AMD Ryzen AI MAX+ 395, versus frozen ActPlane's 33.39–61.02% and 136.94–179.03%, respectively; all 570 security observations pass.

    Source: C. Cost and Frozen-Baseline Comparison · p. 5, §VI · p. 6

  • Takeaways & Limitations

    The results support deterministic kernel enforcement for declared assets, supported paths, and controlled object lifecycles.

    Source: §VI · p. 6

    The claims are scoped to declared assets, implemented kernel paths, and controlled object lifecycles.

    Source: §VI · p. 6

Abstract

from arXiv · show

Large language model agents can execute commands, create subprocesses, and directly access files and networks, allowing prompt injection or planning errors to become operating-system side effects. We present ContractWarden, a Linux reference monitor that enforces a human-authorized damage boundary without trusting the agent or its policy suggestions. A model may propose a tri-state asset contract - allow, deny, or no_egress - but a human makes the final choice. An execution gate binds the contract to a concrete task before untrusted code runs. An extended Berkeley Packet Filter (eBPF) Linux Security Modules (LSM) data plane then enforces file and network decisions and monotonically propagates no_egress through processes, regular files, pipes, FIFOs, and supported Unix-domain sockets. All 570 runs across 19 security tests satisfy predefined return-value and side-effect criteria. On three co-located file-I/O workloads, median overhead is 11.96-12.89% in a Linux 6.15 virtual machine and 35.79-61.54% on a Linux 6.15 physical platform, lower than the evaluated frozen ActPlane baseline. The results demonstrate deterministic kernel enforcement for declared assets, supported paths, and controlled object lifecycles.

I. INTRODUCTION

LLM agents can turn prompt injection or planning errors into operating-system effects, while application-layer validation cannot constrain the full chain of subprocesses and direct system calls. ContractWarden proposes a human-authorized asset boundary, binds it before execution, and enforces it through kernel state and supported object paths.

I. INTRODUCTION

  • Application-layer validation is insufficient when accepted tool calls expand into shells, interpreters, subprocesses, temporary files, and direct system calls, while late policy attachment and process-tree-only inheritance leave enforcement gaps.Network checks only at connection establishment also miss connections made before a process reads sensitive data.Source: §I · p. 1
  • A model may propose a contract, but a human confirms every action and a privileged control plane installs the complete validated policy before the untrusted task is released.Human confirmation is the trusted authorization root, not a guarantee that asset classification is correct.Source: §I · p. 1
  • ContractWarden binds policy to a concrete task before execution, then monotonically propagates source and no_egress state through supported processes, files, pipes, FIFOs, and Unix sockets.Network egress is checked at socket creation, connection, and send time.Source: §I · p. 1
  • The work evaluates 19 security properties, decomposes costs across four configurations, and compares ContractWarden with frozen ActPlane on virtual and physical platforms.The claims are scoped to declared assets, implemented kernel paths, and the described object-lifecycle constraints.Source: §I · p. 1

II. BACKGROUND AND RELATED WORK

The paper positions ContractWarden between kernel enforcement and agent-runtime policy systems: it uses object-level kernel state to enforce a narrower, human-authorized asset boundary. Its contract and threat model specify the permitted actions, state carried across supported objects, and trusted components.

II. BACKGROUND AND RELATED WORK

  • BPF LSM programs can deny security-sensitive operations, while maps and task or inode storage retain enforcement state on kernel objects.Prior provenance, audit, and information-flow systems motivate object-level correlation; ContractWarden instead targets denial before supported side effects.Source: §II · pp. 1–2
  • Agent-runtime policy systems provide richer agent semantics and can complement kernel monitors, while standard resource boundaries do not automatically propagate task-conditioned egress restrictions through intermediate objects.ActPlane is the closest comparator, but its programmable compliance policies differ from ContractWarden's small human-authorized asset boundary; nonoverlapping semantics are not treated as failures.Source: §II · p. 2

A. Contracts and Threat Model

  • The system model includes a human authorizer, model proposer, task domain, privileged control plane, and kernel enforcer; contracts use allow, deny, or no_egress actions and source-bitmap plus egress-denial state.allow adds no restriction, deny rejects supported file and namespace operations, and no_egress permits local access while preventing managed egress.Source: A. Contracts and Threat Model · p. 2
  • The proposer, task commands, inputs, and ordinary descendants are untrusted; the kernel, BPF/LSM path, privileged control plane, and human's final input are trusted.The task lacks root and kernel-management capabilities.Source: A. Contracts and Threat Model · p. 2
  • Six invariants cover closed authorization, pre-execution binding, object identity, monotonic propagation, pre-side-effect denial, and fail-closed setup.If validation, installation, registration, or read-back fails, the child remains behind its gate.Source: A. Contracts and Threat Model · p. 2

B. Lifecycle and Non-Goals

The lifecycle design controls task cleanup but does not establish that every persistent or external carrier has discarded old security state. The monitor's guarantee is conditional on a complete contract and supported side effects and propagation paths.

B. Lifecycle and Non-Goals

  • Cgroup cleanup waits until the derived process tree is empty, but that does not prove persistent inodes or out-of-cgroup receivers discarded an older source bit.A bounded source position cannot be safely reused without generation tags, complete global liveness accounting, or conservative non-reuse.Source: B. Lifecycle and Non-Goals · p. 2
  • The monitor does not verify plans or optimal human choices, protect undeclared assets, infer implicit or byte-level flows, mediate every IPC or device type, withstand a compromised kernel, or provide in-task declassification.Its invariant is conditional on a complete confirmed contract and supported side effects and propagation paths.Source: B. Lifecycle and Non-Goals · p. 2

C. Authorization and Pre-Execution Binding

A gated launcher and privileged control plane install and verify policy before execution; the kernel then compiles asset rules and propagates and enforces state across supported objects and operations.

C. Authorization and Pre-Execution Binding

  • The launcher blocks a child, obtains a pidfd, and sends task identifiers and the contract over an authenticated channel; the daemon validates, installs, attaches, and reads back state before opening the execution gate.Failures leave the workload blocked and trigger rollback; the pidfd identifies the concrete process object.Source: C. Authorization and Pre-Execution… · p. 2

D. Compilation, Propagation, and Denial

  • Asset policy is keyed by device and inode, with existing directory descendants enumerated and later creations covered by a bounded ancestor walk.Paths beyond 32 ancestors are outside scope; compilation rejects contracts exceeding 4,096 policy keys and does not follow symbolic links into another tree.Source: D. Compilation, Propagation, and Denial · p. 3
  • Regular files, FIFOs, and pipes carry inode state; Unix-stream senders join state into peer-state containers that receivers absorb, preventing ordinary relaying from clearing it.The permission-level approximation can over-propagate state.Source: D. Compilation, Propagation, and Denial · p. 3
  • File checks deny supported operations when task sources intersect an inode's deny bitmap, while a no_egress match sets egress-denial state and socket hooks check creation, connection, and send.Covered file operations include open, create, truncate, unlink, and both rename endpoints; network checks include established connections and connectionless datagrams.Source: D. Compilation, Propagation, and Denial · p. 3
  • Exec preserves task state, and removing an asset rule cannot revoke no_egress already held by a live task or object.Monotonicity prevents ordinary self-declassification but can create false positives; trusted release is outside the task's authority.Source: D. Compilation, Propagation, and Denial · p. 3
  • A cross-process lock serializes writers, and failed policy updates restore affected keys; audit-buffer pressure cannot convert a deny decision into allow.The loader validates schema, asset type, bit consistency, action disjointness, and map layouts.Source: D. Compilation, Propagation, and Denial · p. 3

A. Prototype and Method

The prototype combines user-facing contract tools, a privileged launcher and daemon, and a CO-RE BPF data plane. Performance measurements use randomized paired trials and bootstrap intervals.

A. Prototype and Method

  • The prototype includes ordinary-user asset and contract tools, a C launcher, a privileged daemon, a policy loader, and a CO-RE BPF data plane.It requires BPF LSM, BTF, bpffs, cgroup v2, pidfd, and task/inode local storage.Source: A. Prototype and Method · p. 3
  • Contract validation checks version, task bit, asset identity and type, action-set disjointness, and BPF map key/value layouts.The daemon maintains one BPF instance for multiple tasks.Source: A. Prototype and Method · p. 3
  • Performance configurations use five warmups and 30 randomized measured repetitions; intervals use 10,000 bootstrap resamples of paired overheads.ContractWarden security and cost decomposition run on Linux 7.0, while co-located performance runs use Linux 6.15 in a guest and on a physical platform; absolute times are compared only within a platform batch.Source: A. Prototype and Method · p. 3

B. Security Correctness

Security tests assess system-call return values and resource side effects; all 570 observations pass. Within implemented paths, the cases test source isolation, propagation, and pre-side-effect denial.

B. Security Correctness

  • All 570 observations across 19 cases pass the return-value and side-effect criteria, with zero aggregate ring-buffer drops.Each repetition randomizes the cases and cleans controlled processes and policy between cases.Source: B. Security Correctness · p. 3, Figure 1 · p. 4
  • Cases 3 and 13 test send-stage enforcement, case 11 checks return values and filesystem effects, and case 14 tests pre-execution rejection and rollback.Within implemented paths, the monitor preserves source isolation, monotonic propagation, and pre-side-effect denial.Source: B. Security Correctness · p. 3
  • The test partition includes isolation, network-channel enforcement, and lifecycle cases covering rule replacement, failed installation, object release, PID reuse, and the directory-depth boundary.Network tests include newly created and established channels and all four send interfaces exercised by the harness.Source: B. Security Correctness · p. 4

C. Cost and Frozen-Baseline Comparison

The cost decomposition separates loading, task registration, and asset-policy costs, while co-located file-I/O tests report lower overhead for ContractWarden than frozen ActPlane on both platforms. The baseline property comparison is partial and supports coverage observations, not a general failure count or cross-platform ranking.

C. Cost and Frozen-Baseline Comparison

  • 21.16–35.62% median Full overhead spans the file-I/O cost decomposition; most of the observed increase occurs between Loaded-idle and Tracing, with a smaller Tracing–Full difference.The authors do not interpret the smaller difference as zero policy-lookup cost.Source: C. Cost and Frozen-Baseline Comparison · p. 4, Table V · p. 5
  • The cost decomposition distinguishes Baseline, Loaded-idle, Tracing, and Full, with workloads running one million transactions in each microbenchmark and 700,000 in the 14-asset macrobenchmark.All 420 trials were valid.Source: C. Cost and Frozen-Baseline Comparison · p. 4
  • ActPlane’s one-run comparison across 19 target properties yields 9 Pass, 3 Fail, 4 Partial, 2 Unsupported, and 1 Different.Non-pass outcomes primarily reflect missing enforcement points or different creation, propagation, update, identity, and directory semantics; they are not ten generic failures, and the properties omit some ActPlane temporal-policy features.Source: C. Cost and Frozen-Baseline Comparison · pp. 4–5, Table IV · p. 5
  • Co-located performance trials use identical benchmark code, files, counts, and content hashes, and timing covers steady-state execution rather than startup, model proposal, or human confirmation.The latter are deployment and usability costs, not per-operation data-plane costs.Source: C. Cost and Frozen-Baseline Comparison · p. 5
  • 11.96–12.89% guest overhead and 35.79–61.54% physical-platform overhead for ContractWarden compare with 33.39–61.02% and 136.94–179.03% for frozen ActPlane, respectively.The platforms must be interpreted separately; these results are not an overall feature ranking.Source: C. Cost and Frozen-Baseline Comparison · p. 5

V. DISCUSSION AND LIMITATIONS

The damage-boundary guarantee depends on the human-confirmed contract and on supported propagation choices. Permission-level propagation trades possible over-tainting for bounded state and fewer missed carrier transfers.

A. Authorization and Declassification

  • An omitted asset or permissive human choice remains possible, so enforcement does not establish that the confirmed boundary is objectively correct.User studies are needed for usability, decision time, alert fatigue, and contract-quality claims.Source: A. Authorization and Declassification · p. 5
  • Permission-level propagation can over-taint a task by approximating write capability as actual influence, while keeping state bounded and reducing missed propagation through intermediate carriers.Source: A. Authorization and Declassification · p. 5
  • Restoring egress should require trusted declassification, such as an attested transformation or independently authorized release; ordinary task code must not remove a label by declaring data safe.Source: A. Authorization and Declassification · p. 5

B. Lifecycle and Policy Publication

The discussion bounds lifecycle safety and evaluation claims: source reuse and policy publication have unresolved constraints, and tested workloads do not cover all paths or deployments. Within that scope, the conclusion reports successful security tests and lower co-located overhead than the evaluated frozen ActPlane configuration.

B. Lifecycle and Policy Publication

  • Cgroup drainage confirms that the derived task tree exited, but not that persistent inodes or out-of-cgroup receivers discarded source bits; safe source reuse needs generation tags, global liveness tracking, or conservative non-reuse.Multi-key updates are serialized and rolled back on failure but are not linearizable to concurrent kernel readers; double-buffered maps with a one-key generation switch are a proposed extension.Source: B. Lifecycle and Policy Publication · p. 5

C. Scope and External Validity

  • The prototype excludes undeclared assets, implicit or byte-level flows, some IPC/device classes, a root-compromised host, general in-task declassification, and destination allowlists.Evaluation uses one physical machine, one VM, and file-I/O microbenchmarks; network, fork/IPC, update, concurrent-task, multi-kernel, and realistic agent workloads remain extensions.Source: C. Scope and External Validity · pp. 5–6
  • The 19 properties derive from ContractWarden’s damage-boundary threat model, and the frozen ActPlane comparison uses one execution per property, supporting a coverage observation rather than a repeated pass-rate estimate.Security, decomposition, and co-located measurements use separate kernel batches, and the physical run represents one machine.Source: C. Scope and External Validity · p. 6

VI. CONCLUSION

  • Within the stated scope, ContractWarden binds a human-authorized asset contract to task-level kernel state, and the reported tests pass while co-located tests show lower overhead than evaluated frozen ActPlane.Future work includes generation-safe source reuse, atomic policy publication, trusted declassification, and realistic concurrent agent workloads.Source: §VI · p. 6
Loading 2609.38248v1…