M0NDsuChTiG/cds-host-guardian ? reverse-engineered prompt

Build me a Linux host security tool called CDS Host Guardian that acts like a zero trust bunker for selected trusted cgroups.

I want it to load a kernel level protection layer with eBPF and LSM, and a small Go control program that starts it up and manages the trusted group list. The main behavior should be that only approved cgroup v2 groups can do sensitive things, like mounting filesystems, using ptrace, changing to root style privileges, or making outbound network connections. Everything else should be denied by default.

Make sure there is a simple landing page or status page too, so I can see what the tool is and how to start it. Keep the build and run flow straightforward, with clear instructions for compiling the kernel side and launching the agent. If you need to check current docs or APIs for eBPF and LSM support, do that online.