Add BPF LSM task_kill hook for cross-branch signal isolation

Signed-off-by: Cong Wang <cwang@multikernel.io>

Author: congwang-mk

.gitignore

@@ -11,3 +11,4 @@ build/
 
 # Generated BPF headers (regenerate via: make -C src/branching/process/bpf vmlinux.h)
 src/branching/process/bpf/vmlinux.h
+src/branching/process/bpf/*.o

src/branching/process/bpf/branch_tracker.bpf.c

@@ -2,9 +2,9 @@
 /*
  * branch_tracker.bpf.c — BPF LSM program for branch process tracking.
  *
- * Hooks task_alloc and task_free to inescapably track all descendants
- * of registered branch root PIDs.  Supports atomic fork-denial during
- * branch teardown.
+ * Hooks task_alloc, task_free, and task_kill to inescapably track all
+ * descendants of registered branch root PIDs.  Supports atomic
+ * fork-denial during branch teardown and cross-branch signal isolation.
  *
  * Compile:
  *   clang -g -O2 -target bpf -D__TARGET_ARCH_x86 \
@@ -62,6 +62,43 @@ int BPF_PROG(branch_task_alloc, struct task_struct *task,
 	return 0;
 }
 
+/*
+ * LSM hook: task_kill — fires on signal delivery (kill, tkill, tgkill).
+ *
+ * Enforces cross-branch signal isolation:
+ *   - Untracked process → any target: allowed (parent/orchestrator)
+ *   - Tracked process → same branch: allowed
+ *   - Tracked process → different branch or untracked: denied (-EPERM)
+ *
+ * This prevents a child in one branch from killing processes in
+ * another branch or the parent orchestrator.
+ */
+SEC("lsm/task_kill")
+int BPF_PROG(branch_task_kill, struct task_struct *target,
+	     struct kernel_siginfo *info, int sig,
+	     const struct cred *cred)
+{
+	__u32 sender_pid = bpf_get_current_pid_tgid() >> 32;
+	__u64 *sender_bid = bpf_map_lookup_elem(&branch_pids, &sender_pid);
+
+	/* Untracked sender (parent/orchestrator) — always allow. */
+	if (!sender_bid)
+		return 0;
+
+	__u32 target_pid = BPF_CORE_READ(target, tgid);
+	__u64 *target_bid = bpf_map_lookup_elem(&branch_pids, &target_pid);
+
+	/* Target is not tracked — deny (protects parent). */
+	if (!target_bid)
+		return -1; /* -EPERM */
+
+	/* Both tracked — allow only within the same branch. */
+	if (*sender_bid != *target_bid)
+		return -1; /* -EPERM */
+
+	return 0;
+}
+
 /*
  * LSM hook: task_free — fires when a process exits.
  *