Security model

Trust boundary

Warden enforces a resolved decision; it does not decide what is safe. Executable path, argv, environment, profile, backend selection and policy must come from trusted host configuration or an external policy decision point.

Fail-closed backend selection

Each sealed plan computes required capabilities. Warden selects a backend only when its behavioral probe advertises all of them. An unavailable Seatbelt or Bubblewrap backend does not cause a confined run to use POSIX.

Bubblewrap on Linux

Bubblewrap builds a deny-default filesystem view, uses user/PID/IPC/UTS namespaces, drops capabilities, installs fresh /proc and /dev, and combines a fresh network namespace with architecture-checked seccomp for strong NETWORK_NONE.

Bind sources are canonicalized and identity-checked. Explicit DENY rules become final mount overlays so a broader WRITE grant cannot rename or uncover them.

Seatbelt on Apple Silicon

Seatbelt is supported on native arm64 macOS 15 and newer. The behavioral probe requires the root-owned system sandbox-exec, starts from deny-default SBPL and adds only the resolved READ/WRITE and network operations the plan requires.

Seatbelt is deprecated by Apple. Warden isolates it behind the backend ABI so a future Darwin mechanism can replace it without changing the product policy contract.

Lifecycle limit

PROCESS_CONFINEMENT means the isolation policy follows descendants. It does not mean Warden can always wait or stop a hostile descendant that deliberately creates a new session. No current local backend advertises the stronger complete tree-lifecycle capability.

Receipts and attestation

Execution receipts are immutable snapshots created by this Warden process. Signed release tags, SHA-256 assets and Sigstore provenance establish software origin. Neither mechanism proves that a kernel or policy is vulnerability-free, and execution receipts are not remote attestation.

Report a vulnerability

Use GitHub private vulnerability reporting under Security → Advisories → Report a vulnerability. Do not open a public issue for a suspected vulnerability.