I'll see if I can open source it this weekend. I'm not trying to be the "like and subscribe for updates" but if you want to see it when it's open source I'd suggest following me on Twitter (or Github? Does Github have a follow thing?) cause I won't remember to reply on HN.

Here's a little snippet:

    #[effect::declare(
      args=(inner_tmp as I)
      returns=("/tmp/" + I)
    )]
    fn tmp_dir(inner_tmp: Path) -> Path {
      Path::from("tmp/").join(inner_tmp)
    }

So it can reason about that Path's constraints. When that Path gets used by, say, "File::create(path)", it gets turned into a rule and added to an apparmor policy.

Apparmor doesn't support a "hey I'm a process, please sandbox me" so I have to write a privileged daemon that manages that bit.

I also have a way to apply effects to functions you don't own, mutating functions, functions that branch, etc. None of that is implemented yet, just designed.