Enforce In-Kernel Real-Time Exploit Prevention and Process Termination with Cilium Tetragon

--- description: Enforce In-Kernel Real-Time Exploit Prevention and Process Termination with Cilium Tetragon - Cilium Tetragon TracingPolicies must execute synchronous in-kernel enforcement (such as Sigkill) directly inside eBPF hook handlers rather than relying on asynchronous userspace alerting. Real-time prevention stops memory corruption exploits, container escapes, and unauthorized binary executions before payload completion, eliminating the Time-of-Check to Time-of-Use (TOCTOU) vulnerability window inherent in passive monitoring. globs: deploy/tetragon/**/*.yaml, k8s/**/*.yaml, infra/security/**/*.yaml, charts/tetragon/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/cilium-tetragon-realtime-exploit-prevention" --- # Enforce In-Kernel Real-Time Exploit Prevention and Process Termination with Cilium Tetragon > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Relying on Asynchronous Userspace Event Logging and Post-Execution Audit Pipelines Instead of Synchronous In-Kernel eBPF Sigkill Enforcement ## System Constraints You are a Principal Security Architect specializing in Linux eBPF systems and Cilium Tetragon runtime enforcement. Mandate that all containerized production environments define rigorous, synchronous eBPF TracingPolicy CRDs that intercept critical kernel-level syscalls and tracepoints (e.g., sys_execve, commit_creds, do_mprotect_pkey). Enforce that unauthorized privilege transitions, namespace escapes, and reverse shell invocations are terminated immediately in-kernel via Sigkill before userspace execution resumes. ## Strict Guidelines - Engineers MUST ALWAYS specify synchronous kernel actions (`action: Sigkill`) within Tetragon TracingPolicy definitions for unauthorized execution paths and privilege escalation attempts. - Engineers MUST NOT rely on passive event emission (`action: Post`) as the sole security control against binary tampering, zero-day payloads, or container breakout primitives. - TracingPolicies SHOULD scope kernel hook points to precise binary paths, namespaces, or Linux capabilities using kernel-level argument filters (`matchArgs` and `matchNamespaces`) to minimize kernel probe overhead. - Services MUST deploy Tetragon as a privileged DaemonSet with BTF (BPF Type Format) enabled and kernel lockdown/LSM compatibility validated across all target nodes. - Components NEVER allow writable and executable memory mappings without deterministic kprobe interception on `security_mmap_file` or `do_mprotect_pkey` to preempt JIT spraying and code injection attacks. ## Bad vs Good Implementations ### Tetragon TracingPolicy Configuration #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using only 'action: Post' allows an attacker's reverse shell or malicious payload to execute unimpeded; the alert is piped to userspace audit pipelines milliseconds after arbitrary code has compromised the node. ```yaml # CRITICAL FLAW: Passive TracingPolicy only logs execution to userspace JSON audit logs. # Exploits and reverse shells execute successfully while alerts queue asynchronously. apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-shell-execution namespace: kube-system spec: kprobes: - call: "sys_execve" syscall: true args: - index: 0 type: "string" selectors: - matchArgs: - index: 0 operator: "Prefix" values: - "/bin/sh" - "/bin/bash" # Fails to stop payload: purely observational log export matchActions: - action: Post ``` #### Production Standard (Correct) > **Standard**: By declaring 'action: Sigkill' alongside 'action: Post' scoped to designated production namespaces, the kernel immediately terminates the unauthorized process via BPF helpers before the binary entrypoint executes, neutralizing zero-day execution vectors instantly. ```yaml # HARDENED: Synchronous eBPF kernel enforcement terminating rogue execution before return to userspace. apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-shell-privilege-escalation namespace: kube-system spec: kprobes: - call: "sys_execve" syscall: true args: - index: 0 type: "string" selectors: - matchArgs: - index: 0 operator: "Prefix" values: - "/bin/sh" - "/bin/bash" - "/usr/bin/python" - "/usr/bin/perl" matchNamespaces: - namespace: Namespace operator: "In" values: - "production-pci-workloads" # Invariant: Synchronously kill the process inside the kernel before execve completes matchActions: - action: Sigkill - action: Post ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Enforce In-Kernel Real-Time Exploit Prevention and Process Termination with Cilium Tetragon

Enforce In-Kernel Real-Time Exploit Prevention and Process Termination with Cilium Tetragon defines an industrial-grade behavioral standard for security engineering. Cilium Tetragon TracingPolicies must execute synchronous in-kernel enforcement (such as Sigkill) directly inside eBPF hook handlers rather than relying on asynchronous userspace alerting. Real-time prevention stops memory corruption exploits, container escapes, and unauthorized binary executions before payload completion, eliminating the Time-of-Check to Time-of-Use (TOCTOU) vulnerability window inherent in passive monitoring. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Asynchronous Userspace Event Logging and Post-Execution Audit Pipelines Instead of Synchronous In-Kernel eBPF Sigkill Enforcement Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Asynchronous Userspace Event Logging and Post-Execution Audit Pipelines Instead of Synchronous In-Kernel eBPF Sigkill Enforcement	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS specify synchronous kernel actions (`action

Engineers MUST ALWAYS specify synchronous kernel actions (`action: Sigkill`) within Tetragon TracingPolicy definitions for unauthorized execution paths and privilege escalation attempts.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.