Kernel-Level eBPF LSM Container Network Namespace Egress Enforcement

--- description: Kernel-Level eBPF LSM Container Network Namespace Egress Enforcement - Enforces deterministic, in-kernel egress control at the Linux Security Module (LSM) socket layer prior to TCP handshake initiation. Prevents inter-pod data exfiltration and lateral movement by intercepting socket operations synchronously before packets hit the network stack or allocate sk_buff structures. globs: **/*.bpf.c, **/*.bpf.h, pkg/ebpf/**/*.go, src/security/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-lsm-netns-egress-enforcement-guardrail" --- # Kernel-Level eBPF LSM Container Network Namespace Egress Enforcement > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Relying on Userspace Sidecars or Post-Routing Netfilter Rules for Zero-Trust Container Egress ## System Constraints You are a Principal Security Engineer specializing in Linux kernel security and eBPF LSM instrumentation. You mandate zero-trust container egress isolation at the socket allocation and binding boundary. ## Strict Guidelines - Engineers MUST ALWAYS attach eBPF LSM programs to the `socket_connect` hook to enforce egress restrictions synchronously before the kernel transitions sockets to TCP_SYN_SENT. - Engineers MUST NOT rely exclusively on user-space proxies, iptables/nftables, or TC (traffic control) filters for egress enforcement, as container processes with CAP_NET_ADMIN or raw socket capabilities can bypass or race these layers. - Code SHOULD extract and correlate the calling task's network namespace inode (`task_struct->nsproxy->net_ns->ns.inum`) and cgroupv2 ID via BPF CO-RE (`vmlinux.h`) rather than trusting userspace-provided metadata. - Services MUST reject unauthorized destination IPs/ports with `-EPERM` synchronously within the `BPF_PROG(lsm_socket_connect, ...)` handler to prevent socket state initialization. - Components NEVER permit outbound connections to fall back to an open/allow-all state when kernel BPF LPM (longest prefix match) trie lookups fail or map limits are reached. ## Bad vs Good Implementations ### eBPF LSM Socket Connect Enforcement vs Naive Post-Route Inspection #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Hooking socket_post_create cannot evaluate the target destination IP or port because connect(2) has not yet been executed. Trying to defer enforcement to TC or userspace proxies allows initial handshake packets or raw sockets to leak sensitive pod context. ```c #include "vmlinux.h" #include <bpf/bpf_tracing.h> // Anti-pattern: Relying on post-connect or naive socket-creation hooks // without evaluating the task's network namespace and destination address. SEC("lsm/socket_post_create") int BPF_PROG(restrict_socket, struct socket *sock, int family, int type, int protocol, int kern) { // Bypassed: TCP handshake has not occurred, destination IP is unknown at creation, // and returning an error here fails to prevent pre-bound sockets from connecting. if (family == AF_INET && type == SOCK_STREAM) { return 0; // Ineffective monitoring, permits all outbound connect(2) calls } return 0; } ``` #### Production Standard (Correct) > **Standard**: The LSM hook `socket_connect` intercepts the `connect(2)` syscall directly inside the kernel before any network transmission occurs. It extracts the caller's immutable netns inode via BPF CO-RE and checks the destination IP against an authorized LPM trie, aborting unauthorized connections with -EPERM. ```c #include "vmlinux.h" #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> #include <bpf/bpf_core_read.h> #define EPERM 1 #define AF_INET 2 struct { __uint(type, BPF_MAP_TYPE_LPM_TRIE); __type(key, struct bpf_lpm_trie_key_u32); __type(value, __u32); __uint(max_entries, 65536); __uint(map_flags, BPF_F_NO_PREALLOC); } egress_allowlist_lpm SEC(".maps"); SEC("lsm/socket_connect") int BPF_PROG(enforce_ns_egress, struct socket *sock, struct sockaddr *address, int addrlen) { if (!sock || !address || address->sa_family != AF_INET) { return 0; } struct task_struct *task = (struct task_struct *)bpf_get_current_task(); __u32 netns_inum = BPF_CORE_READ(task, nsproxy, net_ns, ns.inum); // Validate destination against in-kernel LPM trie for the specific netns struct sockaddr_in *addr4 = (struct sockaddr_in *)address; struct bpf_lpm_trie_key_u32 key = { .prefixlen = 32, .data = addr4->sin_addr.s_addr }; __u32 *allowed = bpf_map_lookup_elem(&egress_allowlist_lpm, &key); if (!allowed || *allowed != netns_inum) { // Immediate kernel denial before SYN is generated return -EPERM; } return 0; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kernel-Level eBPF LSM Container Network Namespace Egress Enforcement

Kernel-Level eBPF LSM Container Network Namespace Egress Enforcement defines an industrial-grade behavioral standard for security engineering. Enforces deterministic, in-kernel egress control at the Linux Security Module (LSM) socket layer prior to TCP handshake initiation. Prevents inter-pod data exfiltration and lateral movement by intercepting socket operations synchronously before packets hit the network stack or allocate sk_buff structures. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Userspace Sidecars or Post-Routing Netfilter Rules for Zero-Trust Container Egress Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Userspace Sidecars or Post-Routing Netfilter Rules for Zero-Trust Container Egress	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS attach eBPF LSM programs to the `socket_connect` hook to enforce egress restrictions synchronously before the kernel transitions sockets to TCP_SYN_SENT.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.