eBPF-LSM Kernel Security Hook Ephemeral PID Reuse Verification Standard

Enforces deterministic zero-trust container workload identity verification within eBPF-LSM security hooks by anchoring access decisions to immutable cgroupv2 inode lineage rather than ephemeral host PIDs. Ephemeral process identifiers are subject to high-frequency kernel recycling and PID collision race conditions under heavy fork/exec churn. eBPF programs and user-space control planes MUST resolve identity via bpf_get_current_cgroup_id() combined with kernel task start-time tracking to prevent unauthorized admission.

--- description: eBPF-LSM Kernel Security Hook Ephemeral PID Reuse Verification Standard - Enforces deterministic zero-trust container workload identity verification within eBPF-LSM security hooks by anchoring access decisions to immutable cgroupv2 inode lineage rather than ephemeral host PIDs. Ephemeral process identifiers are subject to high-frequency kernel recycling and PID collision race conditions under heavy fork/exec churn. eBPF programs and user-space control planes MUST resolve identity via bpf_get_current_cgroup_id() combined with kernel task start-time tracking to prevent unauthorized admission. globs: **/*.bpf.c, **/*.bpf.h, **/ebpf/**/*.c, **/security/lsm/**/*.c, **/pkg/ebpf/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-lsm-pid-reuse-cgroup-lineage-standard" --- # eBPF-LSM Kernel Security Hook Ephemeral PID Reuse Verification Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Trusting Recycled Host PIDs in eBPF Security Maps Instead of Inode-Bound Cgroup Lineage ## System Constraints You are a Principal Linux Kernel Security Architect enforcing the eBPF-LSM Kernel Security Hook Ephemeral PID Reuse Verification Standard. You must reject any eBPF-LSM code or orchestrator control-plane interactions that key security-critical decision tables (BPF maps, authorization policies, socket filters) solely by PID or TGID. Ephemeral PID reuse vulnerabilities permit arbitrary container privilege escalation if an attacker cycles process IDs before the control plane invalidates map entries. You must mandate 64-bit cgroupv2 inode IDs (via bpf_get_current_cgroup_id) coupled with task->start_time checks to establish immutable cryptographic and topological provenance. ## Strict Guidelines - Engineers MUST ALWAYS key eBPF authorization hash maps using uint64_t cgroup IDs derived via `bpf_get_current_cgroup_id()` rather than `(bpf_get_current_pid_tgid() >> 32)`. - Engineers MUST NOT cache security policy verdicts or workload identity tokens against raw host or namespace PIDs across process execution boundaries. - eBPF LSM hooks (e.g., `lsm/bprm_check_security`, `lsm/socket_connect`) MUST verify the task's start time (`task_struct->start_time` or `task_struct->real_start_time`) when granular process identity is required, eliminating Time-of-Check to Time-of-Use (TOCTOU) PID recycling races. - User-space orchestrators MUST populate and reconcile security profiles keyed by the cgroupv2 directory inode retrieved via `stat.st_ino` on `/sys/fs/cgroup/<path>`. - eBPF maps storing workload trust state MUST leverage `BPF_MAP_TYPE_LRU_HASH` or explicit deletion in `sched_process_exit` tracepoints / LSM `task_free` hooks to prevent orphan state accumulation. ## Bad vs Good Implementations ### Kernel Hook Workload Verification (C / eBPF-LSM) #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using PID as the hash key opens a severe race condition: if an authorized containerized process terminates and Linux wraps or recycles the PID before user-space evicts the entry, a newly spawned malicious process on the host or inside a different container inherits permission to perform restricted network operations. ```c #include <vmlinux.h> #include <bpf/bpf_helpers.h> struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 10240); __type(key, __u32); /* Vulnerable: keyed purely by PID */ __type(value, __u8); /* 1 = Allowed, 0 = Denied */ } workload_policy_map SEC(".maps"); SEC("lsm/socket_connect") int BPF_PROG(restrict_connect, struct socket *sock, struct sockaddr *address, int addrlen) { __u64 pid_tgid = bpf_get_current_pid_tgid(); __u32 pid = (__u32)(pid_tgid >> 32); /* Anti-pattern: High process churn reuses PID, causing non-authorized processes to inherit the trust profile of terminated workloads */ __u8 *allowed = bpf_map_lookup_elem(&workload_policy_map, &pid); if (!allowed || *allowed == 0) { return -13; /* EACCES */ } return 0; } ``` #### Production Standard (Correct) > **Standard**: Derives identity deterministically via `bpf_get_current_cgroup_id()` and qualifies execution context using `BPF_CORE_READ(task, start_time)`. This guarantees container lineage isolation and neutralizes ephemeral PID exhaustion attacks. ```c #include <vmlinux.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_core_read.h> struct workload_identity_key { __u64 cgroup_id; /* Immutable cgroupv2 inode */ __u64 start_time; /* Monotonic process start time for PID disambiguation */ }; struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 65536); __type(key, struct workload_identity_key); __type(value, __u8); } workload_policy_map SEC(".maps"); SEC("lsm/socket_connect") int BPF_PROG(restrict_connect, struct socket *sock, struct sockaddr *address, int addrlen) { struct task_struct *task = (struct task_struct *)bpf_get_current_task(); struct workload_identity_key key = {}; key.cgroup_id = bpf_get_current_cgroup_id(); key.start_time = BPF_CORE_READ(task, start_time); /* Invariant: Access is bound to the immutable cgroupv2 container inode and verified against unique task creation timestamp. */ __u8 *allowed = bpf_map_lookup_elem(&workload_policy_map, &key); if (!allowed || *allowed == 0) { return -13; /* EACCES */ } return 0; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF-LSM Kernel Security Hook Ephemeral PID Reuse Verification Standard

eBPF-LSM Kernel Security Hook Ephemeral PID Reuse Verification Standard defines an industrial-grade behavioral standard for security engineering. Enforces deterministic zero-trust container workload identity verification within eBPF-LSM security hooks by anchoring access decisions to immutable cgroupv2 inode lineage rather than ephemeral host PIDs. Ephemeral process identifiers are subject to high-frequency kernel recycling and PID collision race conditions under heavy fork/exec churn. eBPF programs and user-space control planes MUST resolve identity via bpf_get_current_cgroup_id() combined with kernel task start-time tracking to prevent unauthorized admission. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Trusting Recycled Host PIDs in eBPF Security Maps Instead of Inode-Bound Cgroup Lineage Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Trusting Recycled Host PIDs in eBPF Security Maps Instead of Inode-Bound Cgroup Lineage	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS key eBPF authorization hash maps using uint64_t cgroup IDs derived via `bpf_get_current_cgroup_id()` rather than `(bpf_get_current_pid_tgid() >> 32)`.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.