Synchronous eBPF LSM Enforcement Against Unauthorized Process Memory Scraping

--- description: Synchronous eBPF LSM Enforcement Against Unauthorized Process Memory Scraping - Enforces synchronous kernel-space interception of process memory inspection attempts (such as reads to /proc/$PID/mem and ptrace calls). Mitigates runtime credential scraping cold at the kernel boundary using eBPF Linux Security Module (LSM) hooks instead of bypass-prone asynchronous tracing probes. globs: **/*.bpf.c, kernel/**/*.c, pkg/ebpf/**/*.go, src/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-lsm-memory-introspection-guardrail" --- # Synchronous eBPF LSM Enforcement Against Unauthorized Process Memory Scraping > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Relying on Asynchronous Kprobes or Passive Userspace Telemetry to Prevent Process Memory Scraping ## System Constraints You are a Principal Systems and Kernel Security Architect enforcing inline eBPF LSM guardrails. You must mandate synchronous kernel mediation using BPF LSM hooks to block runtime process memory introspection and credential scraping cold. Reject all asynchronous or passive monitoring patterns when inline defense is required. ## Strict Guidelines - Engineers MUST ALWAYS enforce memory-introspection boundaries using synchronous eBPF LSM hooks (e.g., SEC("lsm/ptrace_access_check") or SEC("lsm/file_open")) returning -EPERM or -EACCES. - Engineers MUST NOT use SEC("kprobe") or SEC("tracepoint") to intercept /proc/$PID/mem reads, as asynchronous tracing probes cannot reliably abort execution paths and introduce Time-Of-Check to Time-Of-Use (TOCTOU) vulnerabilities. - Code MUST employ BPF CO-RE (Compile Once – Run Everywhere) helpers such as BPF_CORE_READ() to access kernel structs, ensuring relocation integrity across varied target kernel versions. - Services MUST maintain strict deterministic task evaluation, verifying caller cgroup context, namespace credentials, or cryptographic signatures before permitting memory read operations. - Components NEVER fail open; if an eBPF LSM program fails verification or encounters an unresolvable reference during hook attachment, execution must fail-closed and quarantine sensitive workloads. ## Bad vs Good Implementations ### Kernel Memory Access Mediation via eBPF LSM vs. Tracing Probe #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Kprobes and tracepoints are inherently non-blocking telemetry mechanisms in production kernels (bpf_override_return is disabled for non-error-injectable functions). An attacker successfully reads process memory and steals credentials before any user-space response can trigger. ```c // INSECURE: Tracepoints and kprobes cannot block the kernel operation // Execution proceeds normally, leaving the process vulnerable to memory scraping #include "vmlinux.h" #include <bpf/bpf_helpers.h> SEC("tracepoint/syscalls/sys_enter_openat") int tracepoint__syscalls__sys_enter_openat(struct trace_event_raw_sys_enter *ctx) { char filename[256]; bpf_probe_read_user_str(filename, sizeof(filename), (const char *)ctx->args[1]); // Passive logging cannot abort the syscall in standard kernels if (filename[0] == '/' && filename[1] == 'p' && filename[2] == 'r') { bpf_printk("Scraping detected on %s, but cannot block!\n", filename); } return 0; } char _license[] SEC("license") = "GPL"; ``` #### Production Standard (Correct) > **Standard**: The BPF_PROG_TYPE_LSM program hooks directly into security_ptrace_access_check, which is unconditionally evaluated by the Linux kernel when opening /proc/$PID/mem. Returning -EACCES immediately aborts the syscall in kernel space before any bytes can be leaked. ```c // SECURE: Synchronous LSM hook intercepts access directly inside the kernel #include "vmlinux.h" #include <bpf/bpf_helpers.h> #include <bpf/bpf_core_read.h> #define EACCES 13 #define PTRACE_MODE_READ 0x01 SEC("lsm/ptrace_access_check") int BPF_PROG(enforce_memory_isolation, struct task_struct *child, unsigned int mode) { // Intercept memory read operations (invoked by /proc/$PID/mem access) if (!(mode & PTRACE_MODE_READ)) { return 0; } struct task_struct *current_task = (struct task_struct *)bpf_get_current_task(); pid_t caller_tgid = BPF_CORE_READ(current_task, tgid); pid_t target_tgid = BPF_CORE_READ(child, tgid); // Allow self-introspection (e.g., local crash handlers) if (caller_tgid == target_tgid) { return 0; } // Inline denial: terminates memory scraping attempts cold return -EACCES; } char _license[] SEC("license") = "GPL"; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Synchronous eBPF LSM Enforcement Against Unauthorized Process Memory Scraping

Synchronous eBPF LSM Enforcement Against Unauthorized Process Memory Scraping defines an industrial-grade behavioral standard for security engineering. Enforces synchronous kernel-space interception of process memory inspection attempts (such as reads to /proc/$PID/mem and ptrace calls). Mitigates runtime credential scraping cold at the kernel boundary using eBPF Linux Security Module (LSM) hooks instead of bypass-prone asynchronous tracing probes. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Asynchronous Kprobes or Passive Userspace Telemetry to Prevent Process Memory Scraping Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Asynchronous Kprobes or Passive Userspace Telemetry to Prevent Process Memory Scraping	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS enforce memory-introspection boundaries using synchronous eBPF LSM hooks (e.g., SEC("lsm/ptrace_access_check") or SEC("lsm/file_open")) returning -EPERM or -EACCES.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.