Cilium Tetragon eBPF Synchronous Kernel Namespace Boundary Enforcement

Enforces in-kernel synchronous execution blocking using Cilium Tetragon TracingPolicies with Sigkill actions for unauthorized namespace boundary crossings, privilege escalations, and container breakouts. Traditional user-space observability agents incur asynchronous event transmission latency, allowing malicious code to persist or execute payloads before remediation occurs. Systems must enforce strict eBPF kprobe/tracepoint hooks to terminate violating processes within the kernel syscall boundary instantly.

--- description: Cilium Tetragon eBPF Synchronous Kernel Namespace Boundary Enforcement - Enforces in-kernel synchronous execution blocking using Cilium Tetragon TracingPolicies with Sigkill actions for unauthorized namespace boundary crossings, privilege escalations, and container breakouts. Traditional user-space observability agents incur asynchronous event transmission latency, allowing malicious code to persist or execute payloads before remediation occurs. Systems must enforce strict eBPF kprobe/tracepoint hooks to terminate violating processes within the kernel syscall boundary instantly. globs: deploy/**/*.yaml, k8s/**/*.yaml, security/**/*.yaml, helm/**/*.yaml, charts/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-tetragon-ebpf-kernel-namespace-boundary-enforcement" --- # Cilium Tetragon eBPF Synchronous Kernel Namespace Boundary Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Relying on Asynchronous User-Space Telemetry Alerts for Container Breakouts Instead of Synchronous Kernel Sigkill Enforcement ## System Constraints You are a Principal Security Architect enforcing Cilium Tetragon eBPF Kernel Namespace Boundary Enforcement. Mandate that all container runtime boundaries, kernel capability modifications, and sensitive namespace crossings (such as setns, unshare, and mount syscalls) are governed by Tetragon TracingPolicy or TracingPolicyNamespaced CRDs configured with synchronous 'Sigkill' actions. Reject configurations that rely purely on asynchronous audit logs, monitoring daemons, or unconstrained privilege delegation without deterministic in-kernel termination hooks. ## Strict Guidelines - Engineers MUST ALWAYS enforce synchronous kernel-level process termination using action: Sigkill on sensitive syscalls (e.g., sys_setns, sys_unshare, sys_capset, sys_pivot_root). - Engineers MUST NOT rely on passive audit-only policies or asynchronous user-space security agents to detect container breakouts and privilege escalation attempts. - TracingPolicies MUST filter matches by container namespace or namespace selector to avoid kernel deadlocks, self-termination loops, or crashing critical host daemons. - Security manifests MUST restrict binary execution vectors (sys_execve) against critical binaries (nsenter, chroot, capsh) within production container namespaces. - Policies SHOULD define granular kernel argument filters (args) and return values to isolate specifically unauthorized namespace transits from legitimate container runtime lifecycle operations. ## Bad vs Good Implementations ### Enforce In-Kernel Sigkill on Unauthorized setns Syscall Execution #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using matchActions: action: Post merely streams the event to Tetragon's user-space agent asynchronously. In a container breakout scenario, the attacker process completes sys_setns, transitions namespaces, and executes arbitrary code long before an out-of-band consumer or SIEM agent can react. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-namespace-breakout spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" # Flaw: No synchronous in-kernel enforcement; logs event to user-space asynchronously selectors: - matchArgs: - index: 1 operator: "Equal" values: - "0" matchActions: - action: Post ``` #### Production Standard (Correct) > **Standard**: Configuring matchActions: action: Sigkill instructs the eBPF program directly within the kernel boundary to send SIGKILL to the offending task before the syscall finishes executing, instantly terminating the breakout vector. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-namespace-breakout spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: Pid operator: In values: - true matchArgs: - index: 1 operator: "Mask" values: - "0x40000000" # CLONE_NEWUSER / CLONE_NEWPID flags matchActions: - action: Sigkill ``` ### Synchronously Block Privilege Escalation via Unauthorized capset Syscall #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Monitoring sys_capset passively via Post allows an attacker who exploited a local kernel vulnerability or misconfiguration to grant themselves full Linux capabilities, persisting their root access immediately. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: monitor-capset spec: kprobes: - call: "sys_capset" syscall: true # Flaw: Missing matchNamespaces and Sigkill; passive monitoring allows root exploitation selectors: - matchActions: - action: Post ``` #### Production Standard (Correct) > **Standard**: Scope enforcement is restricted to workloads inside the production namespace, and Tetragon injects an immediate Sigkill via eBPF if any unauthorized container attempts to manipulate POSIX capabilities via sys_capset. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicyNamespaced metadata: name: enforce-capset-boundary namespace: production spec: kprobes: - call: "sys_capset" syscall: true args: - index: 0 type: "cap_user_header_t" - index: 1 type: "cap_user_data_t" selectors: - matchNamespaces: - namespace: Pid operator: In values: - true matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium Tetragon eBPF Synchronous Kernel Namespace Boundary Enforcement

Cilium Tetragon eBPF Synchronous Kernel Namespace Boundary Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces in-kernel synchronous execution blocking using Cilium Tetragon TracingPolicies with Sigkill actions for unauthorized namespace boundary crossings, privilege escalations, and container breakouts. Traditional user-space observability agents incur asynchronous event transmission latency, allowing malicious code to persist or execute payloads before remediation occurs. Systems must enforce strict eBPF kprobe/tracepoint hooks to terminate violating processes within the kernel syscall boundary instantly. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Asynchronous User-Space Telemetry Alerts for Container Breakouts Instead of Synchronous Kernel Sigkill Enforcement Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Asynchronous User-Space Telemetry Alerts for Container Breakouts Instead of Synchronous Kernel Sigkill Enforcement	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce synchronous kernel-level process termination using action

Engineers MUST ALWAYS enforce synchronous kernel-level process termination using action: Sigkill on sensitive syscalls (e.g., sys_setns, sys_unshare, sys_capset, sys_pivot_root).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.