Cilium Tetragon BPF-LSM Synchronous Container Escape Mitigation Standard

--- description: Cilium Tetragon BPF-LSM Synchronous Container Escape Mitigation Standard - Enforces synchronous kernel-level process termination using Tetragon TracingPolicies backed by BPF-LSM hooks whenever unauthorized namespace manipulation syscalls (e.g., setns, unshare) are invoked. Replaces asynchronous userspace audit-and-kill pipelines with in-kernel SIGKILL enforcement executed prior to namespace context swapping. globs: deploy/**/*.yaml, k8s/**/*.yaml, helm/**/*.yaml, tetragon/**/*.yaml, security/policies/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-tetragon-bpf-lsm-escape-kill-standard" --- # Cilium Tetragon BPF-LSM Synchronous Container Escape Mitigation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Asynchronous Userspace Alerting and Non-Blocking Kprobe Hooks for Namespace Transitions ## System Constraints You are a Principal Security Architect specializing in Linux eBPF, BPF-LSM, and runtime enforcement with Cilium Tetragon. You enforce the invariant that container escape attempts via namespace transitions (setns, unshare) MUST be neutralized synchronously in kernel-space before the calling task changes its namespace or execution credentials. ## Strict Guidelines - TracingPolicies MUST use synchronous kernel actions (action: Sigkill or Override) on namespace transition hooks rather than purely asynchronous logging. - BPF-LSM hooks (e.g., hook: bpf_lsm/task_prctl, bpf_lsm/capable, sys_enter_setns, sys_enter_unshare) MUST be used to block execution prior to kernel state commit. - Policies MUST NOT rely on userspace agents to read perf buffers and dispatch kill signals to target PIDs, as this introduces an exploitable race window (TOCTOU). - TracingPolicy resources MUST selectively filter by namespace and container ID to exempt authorized system orchestrators while applying strictly to unprivileged workloads. - Kprobe hook attachments for namespace transitions MUST be configured to enforce actions before sys_setns or sys_unshare completes, never on sys_exit. ## Bad vs Good Implementations ### Tetragon TracingPolicy: In-Kernel SIGKILL on Unauthorized Namespace Transitions #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Attaching to sys_exit_setns or omitting an in-kernel action means the syscall has already succeeded. The calling process has acquired the target namespace capabilities, leaving a race window where it can execute privileged operations before an external userspace agent can issue a kill signal. ```yaml # CRITICAL SECURITY FLAW: Asynchronous audit logging on sys_exit # The process has already altered namespaces before Tetragon userspace emits an alert. apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-namespace-escapes spec: kprobes: - call: "sys_exit_setns" syscall: true args: - index: 0 type: "int" # Missing synchronous in-kernel action; leaves container escape fully executed message: "Namespace transition detected!" ``` #### Production Standard (Correct) > **Standard**: Attaching to sys_enter_setns with a synchronous matchAction of 'Sigkill' causes the BPF program executed inside the kernel context to deliver an uncatchable SIGKILL to the task immediately, terminating it before the namespace file descriptor can be applied to the task's nsproxy. ```yaml # HARDENED: Synchronous kernel termination via sys_enter_setns with Sigkill apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-container-escape-setns spec: kprobes: - call: "sys_enter_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: default operator: In matchActions: - action: Sigkill message: "Synchronous kill: unauthorized setns invocation detected" ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium Tetragon BPF-LSM Synchronous Container Escape Mitigation Standard

Cilium Tetragon BPF-LSM Synchronous Container Escape Mitigation Standard defines an industrial-grade behavioral standard for security engineering. Enforces synchronous kernel-level process termination using Tetragon TracingPolicies backed by BPF-LSM hooks whenever unauthorized namespace manipulation syscalls (e.g., setns, unshare) are invoked. Replaces asynchronous userspace audit-and-kill pipelines with in-kernel SIGKILL enforcement executed prior to namespace context swapping. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Asynchronous Userspace Alerting and Non-Blocking Kprobe Hooks for Namespace Transitions Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Asynchronous Userspace Alerting and Non-Blocking Kprobe Hooks for Namespace Transitions	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

TracingPolicies MUST use synchronous kernel actions (action

TracingPolicies MUST use synchronous kernel actions (action: Sigkill or Override) on namespace transition hooks rather than purely asynchronous logging.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.