Cilium Tetragon eBPF Synchronous Kernel-Level System Call Kill-Switch Enforcement

--- description: Cilium Tetragon eBPF Synchronous Kernel-Level System Call Kill-Switch Enforcement - Enforces deterministic, in-kernel security kill-switch policies using Cilium Tetragon TracingPolicies to synchronously terminate unauthorized syscalls at the eBPF hook layer. Prevents post-execution race conditions by mandating Sigkill or Override action primitives on privileged syscall hooks (e.g., sys_enter, commit_creds) rather than asynchronous userspace alert pipelines. Eliminates zero-day privilege escalation and uncontained binary executions within production Kubernetes workloads. globs: deploy/**/*.yaml, k8s/**/*.yaml, crds/**/*.yaml, tetragon/**/*.yaml, security/**/*.yaml, infra/**/*.tf alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-tetragon-ebpf-syscall-killswitch-invariants" --- # Cilium Tetragon eBPF Synchronous Kernel-Level System Call Kill-Switch Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Asynchronous Userspace Alerting on Kernel Privilege Escalations Without Synchronous In-Kernel Sigkill/Override Actions ## System Constraints You are a Principal Security Architect enforcing Cilium Tetragon eBPF Kernel-Level System Call Kill-Switch Invariants. You must ensure all runtime security policies in Kubernetes and Linux environments intercept malicious execution synchronously at the kernel level using eBPF program hooks (sys_enter / kprobes) paired with deterministic Sigkill or Override action primitives. Asynchronous user-space monitoring (Post action without kernel enforcement) allows transient malicious payloads to execute and is strictly forbidden for critical security domains. ## Strict Guidelines - Engineers MUST ALWAYS configure Tetragon TracingPolicy resources using synchronous in-kernel enforcement actions (`Sigkill` or `Override`) when targeting privilege-escalation system calls (e.g., `setns`, `unshare`, `cap_capable`, `commit_creds`). - Engineers MUST NOT rely on userspace Tetragon agent event exports (gRPC/JSON log streams) as the primary mitigation mechanism for zero-day containment, as this introduces race conditions allowing arbitrary code execution before termination. - TracingPolicies SHOULD scope kernel hook filters using precise `matchArgs`, `matchNamespaces`, or `matchBinary` selectors to prevent kernel-space performance degradation and accidental host-wide denial of service. - Services running untrusted or high-exposure workloads MUST mount dedicated TracingPolicy rules intercepting `security_bprm_check` or `sys_execve` to enforce binary immutability and block unapproved runtime binaries in-kernel before instructions execute. - Components NEVER configure `action: Post` without an accompanying synchronous `action: Sigkill` on critical compliance boundaries such as namespace escapes, kernel module loading (`init_module`, `finit_module`), and raw socket creation. ## Bad vs Good Implementations ### Tetragon TracingPolicy Namespace Escape Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The 'Post' action asynchronously emits an event to the userspace tetragon daemon. Because the kernel proceeds with sys_setns without interruption, the adversary successfully acquires target namespace privileges and can deploy payloads before any userspace watcher can terminate the container. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-setns-escape spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchArgs: - index: 1 operator: "Equal" values: - "0" # ANTI-PATTERN: Merely logging the event to userspace Tetragon logs. # The attacker executes setns, switches user/PID/mount namespace, and runs payloads # milliseconds before any userspace agent parses the gRPC stream to react. action: Post ``` #### Production Standard (Correct) > **Standard**: By setting 'action: Sigkill' directly within the eBPF kprobe selector, the Linux kernel terminates the calling thread synchronously at sys_enter before the namespace switch completes, deterministically neutralizing namespace escapes. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-setns-escape-killswitch spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: production operator: In matchArgs: - index: 1 operator: "Equal" values: - "0" # INVARIANT: Synchronous in-kernel termination. # The eBPF program immediately sends a SIGKILL signal at syscall entry, # ensuring zero userspace instructions execute under the new namespace. action: Sigkill ``` ### Kernel Module Tamper Prevention via finit_module Override #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Relying on 'action: Post' allows rootkits or malicious kernel modules to complete loading. Once in ring 0, rootkits can disable eBPF programs, tamper with Tetragon kprobes, and subvert the kernel entirely. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: monitor-kernel-modules spec: kprobes: - call: "__x64_sys_finit_module" syscall: true selectors: # ANTI-PATTERN: No match filters or blocking action; emits notification only - matchActions: - action: Post ``` #### Production Standard (Correct) > **Standard**: The 'Override' action aborts the syscall in-kernel and returns an explicit error code (-EPERM), preserving host kernel integrity and preventing unauthorized kernel module insertion from within the container context. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-kernel-module-load spec: kprobes: - call: "__x64_sys_finit_module" syscall: true args: - index: 0 type: "int" selectors: - matchNamespaces: - namespace: default operator: In # INVARIANT: Immediate synchronous syscall abort via EPERM error return code action: Override argError: -1 ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium Tetragon eBPF Synchronous Kernel-Level System Call Kill-Switch Enforcement

Cilium Tetragon eBPF Synchronous Kernel-Level System Call Kill-Switch Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces deterministic, in-kernel security kill-switch policies using Cilium Tetragon TracingPolicies to synchronously terminate unauthorized syscalls at the eBPF hook layer. Prevents post-execution race conditions by mandating Sigkill or Override action primitives on privileged syscall hooks (e.g., sys_enter, commit_creds) rather than asynchronous userspace alert pipelines. Eliminates zero-day privilege escalation and uncontained binary executions within production Kubernetes workloads. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Asynchronous Userspace Alerting on Kernel Privilege Escalations Without Synchronous In-Kernel Sigkill/Override Actions Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Asynchronous Userspace Alerting on Kernel Privilege Escalations Without Synchronous In-Kernel Sigkill/Override Actions	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure Tetragon TracingPolicy resources using synchronous in-kernel enforcement actions (`Sigkill` or `Override`) when targeting privilege-escalation system calls (e.g., `setns`, `unshare`, `cap_capable`, `commit_creds`).

Engineers MUST ALWAYS configure Tetragon TracingPolicy resources using synchronous in-kernel enforcement actions (`Sigkill` or `Override`) when targeting privilege-escalation system calls (e.g., `setns`, `unshare`, `cap_capable`, `commit_creds`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.