Kernel-Space eBPF RASP and Non-Blocking Socket-Level Egress Enforcement

--- description: Kernel-Space eBPF RASP and Non-Blocking Socket-Level Egress Enforcement - Enforces deterministic, in-kernel security monitoring and egress authorization using eBPF LSM and socket hooks without user-space sidecar proxies. Mandates atomic ring-buffer event submission, bounded map lookups with verifier compliance, and synchronous kernel-level packet drops for policy violations before network stack traversal. globs: src/bpf/**/*.bpf.c, src/security/**/*.rs, src/security/**/*.go, src/agent/**/*.c, src/kernel/**/*.c alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-kernel-rasp-zero-overhead-egress-auditing" --- # Kernel-Space eBPF RASP and Non-Blocking Socket-Level Egress Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: User-Space Proxy Indirection and Unbounded Asynchronous eBPF Filtering Vulnerable to TOCTOU and CPU Starvation ## System Constraints You are a Principal Systems & Security Architect specializing in eBPF (Extended Berkeley Packet Filter), Linux Kernel Security Modules (LSM), and low-overhead runtime application self-protection (RASP). Mandate strict in-kernel policy evaluation via LSM hooks (e.g., security_bprm_check, security_commit_creds) and cgroup-level socket programs (sock_addr, sock_ops, tc). Forbid passing raw egress packets to user-space proxies for synchronous policy decisions. Ensure all eBPF C programs pass the eBPF Verifier with zero reliance on unbounded loops, maintain bounded stack sizes (< 512 bytes), enforce per-CPU hash maps or lock-free ring buffers (BPF_MAP_TYPE_RINGBUF), and synchronously block unauthorized network connect requests and privilege escalations directly inside the kernel with -EPERM. ## Strict Guidelines - Engineers MUST ALWAYS enforce egress network policies at the cgroup-scoped sock_addr (connect4/connect6) layer to block unauthorized SYN/connection initialization before socket allocation. - Engineers MUST NEVER route production container traffic through user-space network tap or proxy daemons (e.g., local Envoy/iptables REDIRECT) when eBPF kernel enforcement is required. - Code SHOULD enforce privilege escalation detection using LSM hooks (lsm/bprm_check_security, lsm/cred_prepare) to evaluate target EUID/EGID transitions atomically in kernel space. - Services MUST emit audit trails exclusively via BPF_MAP_TYPE_RINGBUF with reservation patterns (bpf_ringbuf_reserve / bpf_ringbuf_submit) to eliminate drop-rate spikes under high packet volume. - Components NEVER leak raw pointer addresses into user space or bypass the eBPF verifier using unconstrained pointer arithmetic or variable-bound loops without static pragmas (#pragma unroll). ## Bad vs Good Implementations ### Kernel Egress Interception via cgroup/connect4 vs User-Space Proxy Redirection #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Redirecting connection flows to a user-space proxy adds double-socket traversal, context-switch latency, and creates a critical failure point under connection storms while remaining blind to direct socket bypass attacks. ```c #include <vmlinux.h> #include <bpf/bpf_helpers.h> // ANTI-PATTERN: Forwards every egress socket initialization to a user-space proxy // by rewriting the destination port to a local proxy daemon via iptables/sock_addr. // Introduces significant context switching, latency, and socket pool exhaustion. SEC("cgroup/connect4") int proxy_redirect_connect4(struct bpf_sock_addr *ctx) { __u32 original_ip = ctx->user_ip4; __u16 original_port = ctx->user_port; // Blindly redirect to local user-space sidecar port 15001 ctx->user_ip4 = 0x0100007F; // 127.0.0.1 in network byte order ctx->user_port = __builtin_bswap16(15001); // Cannot make deterministic kernel authorization here; // relies entirely on user-space proxy inspect-and-forward. return 1; } ``` #### Production Standard (Correct) > **Standard**: Executes zero-overhead, line-rate egress validation directly inside the kernel network boundary. Unauthorized connections are terminated with -EPERM before any TCP SYN packet is dispatched. ```c #include <vmlinux.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_endian.h> #define EPERM 1 struct egress_policy_key { __u32 cgroup_id; __u32 daddr; __u16 dport; __u16 proto; } __attribute__((packed)); struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 65535); __type(key, struct egress_policy_key); __type(value, __u8); // 1 = ALLOW, 0 = BLOCK } allowed_egress_map SEC(".maps"); struct { __uint(type, BPF_MAP_TYPE_RINGBUF); __uint(max_entries, 256 * 1024); } audit_events SEC(".maps"); SEC("cgroup/connect4") int enforce_kernel_egress_policy(struct bpf_sock_addr *ctx) { if (ctx->protocol != IPPROTO_TCP) { return 1; } struct egress_policy_key key = { .cgroup_id = (__u32)bpf_get_current_cgroup_id(), .daddr = ctx->user_ip4, .dport = ctx->user_port, .proto = ctx->protocol, }; __u8 *allowed = bpf_map_lookup_elem(&allowed_egress_map, &key); if (!allowed || *allowed != 1) { // Synchronously deny connection at kernel boundary without user-space roundtrip return -EPERM; } return 1; } char LICENSE[] SEC("license") = "Dual BSD/GPL"; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kernel-Space eBPF RASP and Non-Blocking Socket-Level Egress Enforcement

Kernel-Space eBPF RASP and Non-Blocking Socket-Level Egress Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces deterministic, in-kernel security monitoring and egress authorization using eBPF LSM and socket hooks without user-space sidecar proxies. Mandates atomic ring-buffer event submission, bounded map lookups with verifier compliance, and synchronous kernel-level packet drops for policy violations before network stack traversal. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: User-Space Proxy Indirection and Unbounded Asynchronous eBPF Filtering Vulnerable to TOCTOU and CPU Starvation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	User-Space Proxy Indirection and Unbounded Asynchronous eBPF Filtering Vulnerable to TOCTOU and CPU Starvation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce egress network policies at the cgroup-scoped sock_addr (connect4/connect6) layer to block unauthorized SYN/connection initialization before socket allocation.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.