Kernel-level security enforcement that follows your containers everywhere.
Write once. Enforce on Linux, Windows, macOS. Block threats before they execute.
Warmor (WebAssembly + Armor) is an autonomous security intelligence platform that enforces security policies at the kernel level using eBPF/LSM hooks and evaluates them in a WebAssembly sandbox. It solves the policy portability problem — write security rules once in YAML or Rust, compile to WASM, and enforce identically across Linux, Windows, and macOS.
Unlike traditional security agents that only monitor, Warmor blocks threats synchronously at the kernel security boundary. Denied operations never execute.
git clone https://github.com/yasindce1998/warmor.git && cd warmor
make all
sudo ./warmor-daemon --policy policy.yaml --lsm-enforceThat's it. Your system is now enforcing security policy at the kernel level.
First time? See the Getting Started Guide for detailed setup instructions, dependency installation, and your first policy walkthrough.
┌─────────────────────────────────────────────────────────────────────┐
│ YAML Policy ──→ warmor-compile ──→ WASM Module ──→ Daemon │
│ │ │
│ ┌──────────┐ ┌──────────────┐ ┌──────────────────┐ │ │
│ │ Kernel │───→│ Ring Buffer │───→│ WASM Evaluator │─┘ │
│ │ LSM/eBPF │←───│ Policy Map │←───│ Decision Cache │ │
│ │ Hooks │ └──────────────┘ └──────────────────┘ │
│ └──────────┘ │
│ execve, openat, connect, sendto, recvfrom, mount, ptrace │
└─────────────────────────────────────────────────────────────────────┘
- Kernel hooks intercept syscalls (LSM-BPF on Linux, eBPF-for-Windows/ETW on Windows, ESF on macOS)
- BPF policy map handles cached decisions in-kernel (<1us) — no userspace round-trip
- WASM sandbox evaluates new events safely — policy bugs can't crash the system
- Decisions feed back into the kernel map, accelerating future identical events
| Platform | Technology | Mode |
|---|---|---|
| Linux | eBPF + LSM-BPF (7 hooks) | Production — kernel-level blocking |
| Windows | eBPF + ETW (hybrid mode) | Beta — kernel network enforcement + reliable telemetry |
| macOS | Endpoint Security Framework | Beta — AUTH event blocking |
| Metric | Value |
|---|---|
| P95 Latency | <100us |
| Cache Hit Rate | >90% (10k LRU) |
| Memory | <50MB |
| CPU Overhead | <5% |
| Kernel fast-path | <1us (BPF map hit) |
- YAML DSL — Declarative rules with glob/regex matching, variables, conditions
- Rust WASM — Full Rust policies compiled to
wasm32-wasifor complex logic - Hot-Reload — SIGHUP to swap policies without restart or downtime
- Two-Tier Cache — First WASM eval compiles into BPF map; subsequent hits handled entirely in kernel
- Policy Signing — Ed25519 signed WASM bundles with verification chain
Warmor goes beyond static policy enforcement — it learns, adapts, and predicts.
Observe containers in learning mode, record every allowed operation, then auto-generate a deny-everything-else policy. Zero manual rule writing.
warmor-learn --duration 30m --all -o learned-policy.yamlReplay days of historical events against a candidate policy before deployment. Know exactly what would break.
warmor-simulate --policy candidate.yaml --data ./events/ --since 7d -o report.jsonPattern-based detection of breakout techniques: nsenter, host filesystem mounts, ptrace across cgroup boundaries, Docker socket access, /proc/*/ns/* traversal, cloud metadata SSRF.
eBPF-powered binary integrity verification at exec time. SHA-256 hash every binary in your image, load the allowlist into a BPF map, and block anything that doesn't match — in kernel, before it runs.
warmor-integrity-scan --rootfs /path -o integrity-db.jsonMaps deny events to MITRE ATT&CK techniques. Builds kill-chain DAGs per container showing progression from reconnaissance through lateral movement to impact.
Real-time graph of container relationships (network connections, shared volumes, IPC namespaces). Query: "If container X is compromised, what can it reach?" — answered via BFS reachability analysis.
Behavioral fingerprinting across your fleet. Same image, different behavior? Z-score based outlier detection flags the anomalous node — potential compromise indicator.
Deploy new policies to a canary cohort. Warmor monitors deny-rate delta in real-time. If the canary exceeds threshold — automatic rollback. No humans in the loop for safety.
Time-dimension constraints that static policies can't express:
- "Init binaries allowed only in first 60 seconds"
- "SSH only Mon-Fri 08:00-18:00"
- "No new binaries from /tmp after container stabilizes (5 min)"
- "Backup file creation only during 02:00-04:00 window"
| Tool | Purpose |
|---|---|
warmor-daemon |
Main enforcement daemon with LSM-BPF hooks |
warmor-server |
Central fleet management, A/B rollouts, drift aggregation |
warmor-compile |
YAML to WASM compilation pipeline |
warmorctl |
Interactive TUI (dashboard, agents, policies, rollouts, certs) |
warmor-learn |
Learning mode — observe and synthesize policies |
warmor-simulate |
Replay historical events against candidate policies |
warmor-integrity-scan |
Build binary hash allowlists for supply chain enforcement |
warmor-policy-gen |
Generate policies from audit logs |
warmor-sbom-policy |
Generate policies from SBOM manifests |
warmor-policy-diff |
Compare two policies and show what changes |
warmor-policy-merge |
Merge multiple policies with conflict resolution |
warmor-policy-bundle |
Package policies into signed OCI bundles |
warmor-oci-hook |
Container runtime hook (containerd/CRI-O integration) |
warmor-dashboard |
Real-time SSE dashboard (policy decisions, counters) |
10 production-ready Rust policy crates covering real-world threat scenarios:
| Policy | Threat Domain | Pattern |
|---|---|---|
advanced |
Process/file enforcement | evaluate_syscall |
cross-platform |
Platform-aware security | C FFI + evaluate |
multi |
Multi-event dispatch | Tagged enum |
container-escape |
Container breakout (12 techniques) | Tagged enum |
supply-chain |
Runtime integrity (9 controls) | Tagged enum |
temporal-access |
Time-based access control (8 rules) | Cross-platform |
zero-trust-net |
Network microsegmentation (10 controls) | Cross-platform |
lateral-movement |
Lateral movement detection (10 techniques) | Tagged enum |
crypto-mining |
Cryptojacking detection (12 indicators) | Tagged enum |
example |
Starter template | evaluate_syscall |
Build any policy:
cd policies/container-escape
cargo build --release --target wasm32-wasi
# Output: target/wasm32-wasi/release/container_escape.wasmSee Rust Policy Examples for full documentation and authoring guide.
helm install warmor deploy/helm/warmor \
--set image.tag=latest \
--set config.lsmEnforce=true \
--set config.policyPath=/etc/warmor/policy.wasmIncludes: DaemonSet with BPF capabilities, RBAC, ServiceMonitor, Grafana dashboards, alert rules.
internal/
enforcer/ — Core event loop, WASM evaluation, LSM integration
ebpf/ — LSM-BPF loader, policy map, ring buffer, CO-RE BTF
wasm/ — Wazero runtime, ABI v2, multi-event dispatch
cache/ — Decision cache with BPF map sync
streaming/ — Pipeline: enrichers → sinks (Prometheus, SIEM, file)
policyserver/ — Fleet management, A/B rollouts, canary analyzer
lineage/ — Process tree tracking (parent/child/cgroup ancestry)
container/ — Runtime detection (Docker, containerd, CRI-O, Podman)
learner/ — Learning mode recorder + policy synthesizer
simulator/ — Event replay engine for policy testing
integrity/ — Binary hash verification (SHA-256 + FNV-1a fast path)
escape/ — Container escape pattern correlator
drift/ — Behavioral fingerprint + z-score anomaly detection
attackgraph/ — MITRE ATT&CK correlation + kill-chain DAG
blastradius/ — Container relationship graph + BFS reachability
temporal/ — Time-dimension enricher + constraint evaluation
compiler/ — YAML → Rust → WASM compilation pipeline
platform/ — OS abstraction (Linux eBPF, Windows ETW, macOS ESF)
crypto/ — mTLS (Ed25519), JWT (HMAC+EdDSA), policy signing
metrics/ — Prometheus counters, histograms, gauges
logging/ — Structured JSON (zerolog), Windows Event Viewer integration
dashboard/ — Real-time SSE dashboard (ring buffer, embedded HTML)
See Architecture Deep Dive for data flow diagrams.
| Category | Documents |
|---|---|
| Getting Started | Quick Start • Build Guide • Getting Started |
| Architecture | System Design • Security Posture • BPF Compatibility |
| Platforms | Linux • Windows • macOS |
| Policies | Authoring Guide • Rust Examples • YAML DSL |
| Toolchain | Policy Gen • SBOM Enforcement • Diff • Merge • Bundle |
| Intelligence | Learning Mode • Simulator • Escape Detection • Supply Chain |
| Fleet | Canary Rollout • Drift Detection • Attack Graph • Blast Radius • Temporal |
| Kubernetes | CRD Usage • Helm Chart |
| Project | Overview • PRD, Phase Tracking & Roadmap |
We welcome contributions! Open an issue or pull request.
High-impact areas:
- Windows eBPF kernel enforcement
- macOS ESF blocking mode improvements
- New Rust WASM policy crates (threat detection scenarios)
- Performance benchmarks and optimization
- Integration tests on additional kernel versions
MIT License. See LICENSE.
- cilium/ebpf — eBPF library for Go
- tetratelabs/wazero — Pure Go WebAssembly runtime (zero dependencies)
- Rust — Policy implementation language
- MITRE ATT&CK — Threat framework for attack graph correlation
Warmor v0.1.0 — From policy enforcement to autonomous security intelligence.
Issues • Discussions