In-Kernel eBPF LSM Container Syscall Whitelist & Namespace Containment

--- description: In-Kernel eBPF LSM Container Syscall Whitelist & Namespace Containment - Mandates deterministic, zero-trust container syscall whitelisting enforced strictly via eBPF Linux Security Module (LSM) hooks bound to cgroupv2 hierarchies. Eliminates Time-of-Check to Time-of-Use (TOCTOU) exploits and container namespace escapes by executing sub-millisecond, synchronous kernel-level authorization checks before execution traverses isolation boundaries. Replaces reactive, post-execution userspace auditing with pre-execution in-kernel denial via negative errno returns. globs: **/*.bpf.c, **/*.bpf.h, pkg/security/**/*.go, src/security/**/*.rs, policies/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-lsm-container-syscall-whitelist-standard" --- # In-Kernel eBPF LSM Container Syscall Whitelist & Namespace Containment > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Asynchronous Userspace Tracepoint Auditing or Fragile Blacklist-Based Syscall Filtering ## System Constraints You are a Principal Security Systems Architect enforcing strict in-kernel eBPF LSM security standards. All container syscall evaluation and boundary isolation must execute within kernel space via deterministic LSM hooks, default-deny whitelisting, and cgroupv2 scoping. Never rely on asynchronous tracepoints, kprobes, or userspace-only mediation for enforcement. ## Strict Guidelines - Engineers MUST ALWAYS enforce syscall and execution controls using synchronous eBPF LSM hooks (e.g., 'lsm/bprm_check_security', 'lsm/file_open', 'lsm/task_prctl') returning -EPERM on policy violations. - Engineers MUST NOT rely on kprobes, kretprobes, or tracepoints for security gating, as they are non-blocking, vulnerable to TOCTOU race conditions, and lack veto capability. - Code MUST isolate policy evaluation to specific container scopes by extracting and validating the cgroupv2 hierarchy using 'bpf_get_current_cgroup_id()' against registered container runtime maps. - Security policies MUST adopt a strict default-deny whitelist model where only pre-authorized binary hashes and syscall numbers are permitted within container cgroups. - Telemetry and security audit events MUST use lock-free eBPF ring buffers ('bpf_ringbuf_output') with reserved non-blocking fallbacks, ensuring telemetry collection never delays synchronous in-kernel blocking. ## Bad vs Good Implementations ### Synchronous eBPF LSM In-Kernel Enforcement vs. Asynchronous Tracepoint Auditing #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Tracepoints execute asynchronously relative to access authorization; they cannot abort kernel execution paths or block zero-day escapes before payload execution begins, introducing exploitable TOCTOU windows. ```c // Anti-pattern: Tracepoint-based monitoring cannot block executions and causes TOCTOU leaks #include <vmlinux.h> #include <bpf/bpf_helpers.h> SEC("tracepoint/syscalls/sys_enter_execve") int tracepoint_execve_entry(struct trace_event_raw_sys_enter *ctx) { // Tracepoints only provide post-invocation observability. // Execution cannot be preemptively aborted or denied here; // malicious payloads cross namespace boundaries before userspace receives alerts. bpf_printk("execve detected in container process\n"); return 0; } char _license[] SEC("license") = "GPL"; ``` #### Production Standard (Correct) > **Standard**: Utilizes the LSM hook 'bprm_check_security' to synchronously intercept execution candidates inside designated cgroups. Returning -EPERM stops execution before kernel structures are modified or namespace barriers are traversed. ```c // Production Standard: Synchronous eBPF LSM hook providing sub-millisecond in-kernel blocking #include <vmlinux.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_core_read.h> #include <bpf/bpf_tracing.h> #define EPERM 1 struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 10240); __type(key, u64); // cgroup_id __type(value, u32); // policy flags } monitored_containers SEC(".maps"); SEC("lsm/bprm_check_security") int BPF_PROG(enforce_container_exec, struct linux_binprm *bprm) { u64 cgroup_id = bpf_get_current_cgroup_id(); u32 *policy = bpf_map_lookup_elem(&monitored_containers, &cgroup_id); // If process is not part of a monitored container sandbox, allow standard execution if (!policy) { return 0; } // Default-deny invariant: Block unauthorized binary invocation directly in kernel space if (!(*policy & 0x1)) { return -EPERM; } return 0; } char _license[] SEC("license") = "GPL"; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: In-Kernel eBPF LSM Container Syscall Whitelist & Namespace Containment

In-Kernel eBPF LSM Container Syscall Whitelist & Namespace Containment defines an industrial-grade behavioral standard for security engineering. Mandates deterministic, zero-trust container syscall whitelisting enforced strictly via eBPF Linux Security Module (LSM) hooks bound to cgroupv2 hierarchies. Eliminates Time-of-Check to Time-of-Use (TOCTOU) exploits and container namespace escapes by executing sub-millisecond, synchronous kernel-level authorization checks before execution traverses isolation boundaries. Replaces reactive, post-execution userspace auditing with pre-execution in-kernel denial via negative errno returns. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Asynchronous Userspace Tracepoint Auditing or Fragile Blacklist-Based Syscall Filtering Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Asynchronous Userspace Tracepoint Auditing or Fragile Blacklist-Based Syscall Filtering	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce syscall and execution controls using synchronous eBPF LSM hooks (e.g., 'lsm/bprm_check_security', 'lsm/file_open', 'lsm/task_prctl') returning -EPERM on policy violations.

Engineers MUST ALWAYS enforce syscall and execution controls using synchronous eBPF LSM hooks (e.g., 'lsm/bprm_check_security', 'lsm/file_open', 'lsm/task_prctl') returning -EPERM on policy violations.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.