Analyzing the structural failure of the `execve()` primitive in Unix-like kernels

Overview

This research focuses on replacing the traditional Unix execve() system call—which relies on software-defined privilege levels—with hardware-isolated process-spawning mechanisms designed for Sovereign Agent runtimes. Traditional process execution is vulnerable to local privilege escalation (LPE) because it depends on Memory Management Unit (MMU)-based protection, which is often insufficient to stop sophisticated memory corruption or side-channel attacks. By shifting the Trusted Computing Base (TCB) from the kernel software to the silicon, this approach utilizes Capability-Based Access Control (CBAC) and Trusted Execution Environments (TEEs) to prevent unauthorized privilege escalation at the microarchitectural level [C004, C005].

This transition is critical because autonomous agents are evolving from text generators into "system orchestrators" that execute deterministic tool calls ^[C008]. When an LLM's probabilistic output is translated into system commands, any semantic hallucination or prompt injection can be weaponized to exploit execve() vulnerabilities. To mitigate this, sovereign runtimes implement "execution authorities"—such as FemtoClaw's Rust-native wrappers—to ensure that agent actions are syntactically safe and constrained by hardware-enforced boundaries before they ever reach the processor ^[C008].

The following table contrasts the structural failures of traditional Unix-like process spawning with the proposed hardware-isolated mechanism:

To achieve this, the architecture integrates Privacy-preserving Virtual Machines (PPVM) that use lightweight VM forking and copy-on-write mechanisms to isolate confidential application footprints from the parent VM ^[C003]. This ensures that agentic workloads run in air-gapped Security Enclaves, separating model inference and tool execution from the host system to eliminate remote injection vectors and credential leakage [C001, C009].

Landscape

Current efforts to replace traditional execve() primitives with hardware-isolated spawning mechanisms fall into three primary architectural categories: hardware-capability models, enclave-based virtualization, and type-safe mediation layers.

hardware-Capability Models
The most fundamental shift moves trust from the software kernel to the silicon. CHERI (Capability hardware Enhanced RISC Instructions) replaces traditional pointers with capabilities to enforce fine-grained memory protection and scalable compartmentalization at the ISA level [C005, C006, C007]. Similarly, Keystone provides an open-source framework for building customized Trusted Execution Environments (TEEs) on RISC-V, utilizing hardware memory isolation to minimize the Trusted Computing Base (TCB) ^[C004].

Enclave and Virtualization Isolation
Other approaches utilize "hard" boundaries to isolate agent processes from the host system. MX4 AI's Platform Runtime employs security enclaves to separate model inference from the host, offering air-gapped deployment to eliminate external attack vectors ^[C001]. Clawstack implements a "dark node" architecture using private vSwitch backhaul to keep compute off the public internet, combined with disk and memory snapshots for deterministic failure replay ^[C000]. At the VM level, the PPVM (Privacy-preserving Virtual Machine) uses lightweight VM fork operations to isolate confidential application footprints, ensuring that hypervisor features like checkpointing cannot expose sensitive data ^[C003].

Type-Safe Mediation and Governance
A third approach focuses on the "determinism gap" between LLM reasoning and system execution. FemtoClaw uses a Rust-native execution authority to wrap LLM outputs in strict Rust types, ensuring that agent actions conform to business rules before they reach the hardware ^[C008]. This is complemented by governance-first operating systems like Sovereign-OS, which uses a declarative YAML Charter to enforce fiscal boundaries and "earned-autonomy" permissions via a dynamic TrustScore ^[C002].

Key Findings

Research into hardware-isolated runtimes shows a shift toward moving the Trusted Computing Base (TCB) from the kernel into the silicon. CHERI implements this via an architecture-neutral capability-based protection model, utilizing fat-pointers to enforce memory protection and capability integrity [C005, C006]. This allows for deterministic, non-probabilistic software compartmentalization that exceeds the capabilities of standard Memory Management Unit (MMU) protection [C006, C007].

For agentic runtimes, isolation is being achieved through three distinct hardware-centric layers:
1. Custom TEEs: Keystone provides a framework for building customized Trusted Execution Environments (TEEs) on unmodified RISC-V hardware, allowing developers to define memory isolation and programmable layers beneath the untrusted OS ^[C004].
2. Memory Footprint Isolation: The Privacy-preserving Virtual Machine (PPVM) utilizes VM fork operations to isolate a confidential application's memory footprint, ensuring that hypervisor features like checkpointing cannot expose sensitive data ^[C003].
3. Air-Gapped Enclaves: MX4 AI utilizes security enclaves to physically separate model inference from the host system, supplemented by air-gapped deployment options to eliminate external attack vectors ^[C001].

There is a consensus across sovereign infrastructure providers that shared cloud environments introduce systemic risks, such as MITM attack surfaces and remote injection vectors identified in the mcp Top 10 ^[C009]. Consequently, architectures like Clawstack are moving toward dedicated hardware with "dark node" private vSwitch backhaul to keep compute off the public internet ^[C000].

However, sources diverge on where the primary "governance" of the agent should reside—in the hardware primitive or the mediation layer:

While FemtoClaw focuses on bridging the gap between probabilistic reasoning and deterministic control through strict Rust types ^[C008], Sovereign-OS implements a governance-first approach where a "CFO" component gates expenditures via an auction-based bidding engine and SHA-256 proof hashes ^[C002]. These findings suggest that preventing privilege escalation requires a stack that combines CHERI-style capability hardware ^[C005] with high-level constitutional constraints ^[C002].

Tensions and Tradeoffs

Practitioners implementing hardware-isolated process spawning must navigate the tension between isolation granularity and system overhead. Coarse-grained isolation, such as the Privacy-preserving Virtual Machine (PPVM), utilizes lightweight VM forks to isolate memory footprints ^[C003]. While this provides transparency for the parent VM, it lacks the precision of instruction-level protection. Conversely, CHERI enforces fine-grained memory protection and scalable compartmentalization [C005, C006]. This shifts the security burden from software-defined boundaries to hardware-enforced monotonicity, reducing performance overhead for compartmentalization but requiring specific ISA support (e.g., RISC-V or Arm Morello) [C005, C007].

The transition to sovereign runtimes introduces a conflict between autonomous reasoning capacity and data sovereignty. Local-first architectures eliminate MITM attack surfaces and remote injection vectors by keeping tool registrations and API keys on local hardware ^[C009]. However, this creates a "cognitive ceiling" where agents are limited by the reasoning capabilities of local models compared to cloud-hosted alternatives like OpenAI Operator or Claude Managed Agents ^[C009].

Finally, there is a tension between execution velocity and runtime governance. Sovereign-OS implements a "governance-first" approach where every agent action is gated by a CFO (Treasury) for fiscal boundaries and an Auditor for SHA-256 proof verification ^[C002]. While this prevents 100% of fiscal violations, it introduces latency and complexity into the execution pipeline ^[C002]. This contrasts with the approach taken by FemtoClaw, which prioritizes deterministic system control by wrapping LLM outputs in strict Rust types to ensure syntactic correctness without imposing heavy fiscal or constitutional gating ^[C008].

Opportunities

Systems to Build

• Capability-Based Process Spawning: Replace the ambient authority of execve() with a mechanism using CHERI's tagged memory and capability registers ^[C005]. This prevents local privilege escalation by requiring unforgeable, monotonic tokens for memory access rather than relying on software-defined privilege levels [C006, C007].
• hardware-Isolated Execution Authorities: Integrate FemtoClaw's Rust-native type wrapping with Keystone's RISC-V TEE primitives [C004, C008]. This architecture ensures that probabilistic LLM outputs are syntactically validated via strict Rust types before being committed to a hardware-isolated enclave.
• Confidential Agent Sub-processes: Implement a PPVM (Privacy-preserving Virtual Machine) architecture to isolate the memory footprint of confidential agent tasks ^[C003]. This allows the parent VM to perform checkpointing while excluding or encrypting the child VM's memory, preventing data leakage during state persistence ^[C003].
• Atomic state Recovery Runtimes: Develop a runtime utilizing Clawstack's memory and disk snapshotting to enable deterministic rollbacks and "time-travel debugging" for autonomous agent failures ^[C000].

Technical Trade-offs in Isolation

Critical Questions for Investigation

• TrustScore Integration: Can the dynamic TrustScore from Sovereign-OS be mapped directly to CHERI's monotonic capabilities to automate the granting of hardware-level permissions based on cryptographic audit proofs [C002, C005]?
• PPVM Performance: Does the copy-on-write fork in a PPVM provide lower overhead for high-frequency agentic sub-task spawning compared to standard microVMs ^[C003]?
• Air-gapped Visibility: How can MX4 AI's infrastructure activity journaling be implemented as a tamper-evident hardware log to ensure operational visibility without compromising air-gapped security ^[C001]?
• Semantic Guardrails: How can FemtoClaw's deterministic tool-calling be extended into the hardware layer to prevent "semantic hallucinations" from triggering catastrophic system calls ^[C008]?

References

• [C000] The Arm64 memory tagging extension in Linux [LWN.net] — https://lwn.net/Articles/834289/
• [C001] config_arm64_mte - kernelconfig.io — https://www.kernelconfig.io/config_arm64_mte
• [C002] ARM64 Reversing Part 10: Intro to ARM MTE | 8kSec — https://8ksec.io/arm64-reversing-and-exploitation-part-10-intro-to-arm-memory-tagging-extension-mte/
• [C003] Understanding and mitigating memory corruption attacks — https://doi.org/10.17760/d20467218
• [C004] Tiktag: Breaking ARM's Memory Tagging Extension with Speculative Execution — https://doi.org/10.1109/sp61157.2025.00039
• [C005] Capacity: Cryptographically-Enforced In-Process Capabilities for Modern ARM Architectures — https://doi.org/10.1145/3576915.3623079
• [C006] Towards Linux Kernel Memory Safety — https://arxiv.org/abs/1710.06175
• [C007] PDFArmv8.5-A Memory Tagging Extension - Arm Developer — https://developer.arm.com/-/media/Arm+Developer+Community/PDF/Arm_Memory_Tagging_Extension_Whitepaper.pdf
• [C008] ARMv8.5-A Memory Tagging Extension (MTE) Explained — https://www.allpcb.com/allelectrohub/armv85-a-memory-tagging-extension-mte-explained
• [C009] Introduction to Arm Memory Tagging Extensions :: Thore Göbel — https://thore.io/posts/2025/09/introduction-to-arm-memory-tagging-extensions/