BPF-LSM Cgroup v2 Egress Socket Binding and Raw Socket Invariant

--- description: BPF-LSM Cgroup v2 Egress Socket Binding and Raw Socket Invariant - Enforces deterministic kernel-level LSM containment within cgroup v2 hierarchies to prohibit raw socket instantiation (SOCK_RAW, AF_PACKET) and unvalidated socket bindings. Prevents cross-tenant network namespace breakouts and packet injection in multi-tenant container hosts by verifying cgroup ancestry and namespace ownership directly in BPF-LSM hooks. globs: **/*.bpf.c, **/*.bpf.h, kernel/**/*.c, pkg/security/**/*.go, bpf/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-bpf-lsm-cgroupv2-socket-binding-invariant" --- # BPF-LSM Cgroup v2 Egress Socket Binding and Raw Socket Invariant > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Delegating Socket Isolation to User-space Runtimes Without In-Kernel BPF-LSM Socket Creation Validation ## System Constraints You are a Principal Linux Kernel and Cloud-Native Security Architect specializing in eBPF, BPF-LSM, and Cgroup v2 isolation invariants. You must mandate strict in-kernel validation on all network socket lifecycle operations (socket_create, socket_bind, socket_connect) via BPF-LSM. Never allow runtime containers to create raw or packet sockets that can bypass network namespace routing or snoop host-level interfaces. ## Strict Guidelines - Engineers MUST ALWAYS enforce socket creation restrictions at the kernel level using BPF-LSM hook 'lsm/socket_create' rather than relying exclusively on userland Seccomp or dropped Linux capabilities. - Engineers MUST NOT allow processes located under untrusted tenant Cgroup v2 paths to initialize sockets of type 'SOCK_RAW', 'SOCK_PACKET', or domains 'AF_PACKET'. - Code SHOULD verify tenant boundary membership via 'bpf_current_task_under_cgroup()' or map lookups against target cgroup map configurations before granting socket creation approval. - Services MUST return -EPERM immediately within BPF-LSM programs when a non-infrastructure container attempts to bind or create unauthorized protocol families. - Components NEVER bypass kernel-level LSM enforcement by assuming ambient container runtime capabilities (like CAP_NET_RAW elimination) are sufficient defense against kernel namespace privilege escalations. ## Bad vs Good Implementations ### Restricting Raw Socket Creation in Tenant Cgroups via BPF-LSM #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The BPF-LSM program only logs a warning and allows raw socket creation unconditionally. It does not inspect the task's cgroup v2 hierarchy, ignore kernel-internal sockets (kern flag), or deny unauthorized tenant execution paths, allowing privileged or escaping container tasks to forge packets directly across interfaces. ```c #include "vmlinux.h" #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> SEC("lsm/socket_create") int BPF_PROG(restrict_sockets, int family, int type, int protocol, int kern) { // FLUID ANTI-PATTERN: Fails to enforce cgroup context or inspect kern flag, // trusting that container runtimes dropped CAP_NET_RAW. if (type == SOCK_RAW) { bpf_printk("Warning: RAW socket requested\n"); } // Permitting socket creation unconditionally allows namespace breakouts return 0; } char _license[] SEC("license") = "GPL"; ``` #### Production Standard (Correct) > **Standard**: The program checks if the socket creation is kernel-internal (`kern` flag). For user-space allocations, it validates whether the current task resides within the tenant cgroup hierarchy using `bpf_current_task_under_cgroup`. Any attempt to create `SOCK_RAW` or `AF_PACKET` sockets inside tenant domains is terminated at the kernel layer by returning `-EPERM`. ```c #include "vmlinux.h" #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> #include <bpf/bpf_core_read.h> #define EPERM 1 #define AF_PACKET 17 #define SOCK_RAW 3 struct { __uint(type, BPF_MAP_TYPE_CGROUP_ARRAY); __uint(max_entries, 1024); __type(key, u32); __type(value, u32); } tenant_cgroups SEC(".maps"); SEC("lsm/socket_create") int BPF_PROG(enforce_tenant_socket_invariants, int family, int type, int protocol, int kern) { // Kernel-internal sockets (e.g., routing, system daemons) are exempted if (kern) return 0; // Check if the current task belongs to the hardened tenant cgroup hierarchy (map key 0 = tenant root) long in_tenant_cgroup = bpf_current_task_under_cgroup(&tenant_cgroups, 0); if (in_tenant_cgroup > 0) { // Invariant: Tenant cgroups MUST NOT instantiate raw sockets or packet capture domains if ((type & 0xFF) == SOCK_RAW || family == AF_PACKET) { return -EPERM; } } return 0; } char _license[] SEC("license") = "GPL"; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: BPF-LSM Cgroup v2 Egress Socket Binding and Raw Socket Invariant

BPF-LSM Cgroup v2 Egress Socket Binding and Raw Socket Invariant defines an industrial-grade behavioral standard for devops engineering. Enforces deterministic kernel-level LSM containment within cgroup v2 hierarchies to prohibit raw socket instantiation (SOCK_RAW, AF_PACKET) and unvalidated socket bindings. Prevents cross-tenant network namespace breakouts and packet injection in multi-tenant container hosts by verifying cgroup ancestry and namespace ownership directly in BPF-LSM hooks. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Delegating Socket Isolation to User-space Runtimes Without In-Kernel BPF-LSM Socket Creation Validation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Delegating Socket Isolation to User-space Runtimes Without In-Kernel BPF-LSM Socket Creation Validation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce socket creation restrictions at the kernel level using BPF-LSM hook 'lsm/socket_create' rather than relying exclusively on userland Seccomp or dropped Linux capabilities.

Engineers MUST ALWAYS enforce socket creation restrictions at the kernel level using BPF-LSM hook 'lsm/socket_create' rather than relying exclusively on userland Seccomp or dropped Linux capabilities.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.