eBPF LSM In-Kernel Real-Time Capability Fence for Container Isolation

Q: How does adopting this rule prevent AI hallucinations?

This rule explicitly declares what the AI must avoid (Relying on Asynchronous User-Space Daemons or Kprobes for Security Enforcement) and prescribes verified positive examples. Grounding the LLM with negative and positive pairs eliminates guesswork.

Q: Which AI coding environments are supported?

This specification is multi-platform compatible: Cursor (.cursor/rules/*.mdc & .cursorrules), Anthropic Claude Code (CLAUDE.md), Windsurf (.windsurfrules), Codex / Cline (AGENTS.md), and GitHub Copilot (.github/copilot-instructions.md).

Q: Can I combine this rule with other technology stacks?

Yes. Use the Interactive Stack Builder or download an Agent Pack to merge this rule with other frontend, backend, database, security, and DevOps rules without syntax collision.

eBPF LSM In-Kernel Real-Time Capability Fence for Container Isolation

--- description: eBPF LSM In-Kernel Real-Time Capability Fence for Container Isolation - Enforces synchronous, in-kernel privilege fencing via eBPF Linux Security Module (LSM) hooks to prevent container breakouts and unauthorized capability transitions. Eliminates Time-of-Check to Time-of-Use (TOCTOU) race conditions and user-space daemon latency by resolving security decisions entirely within kernel space before execution. globs: **/*.bpf.c, **/*.bpf.h, src/security/**/*.c, src/bpf/**/*.rs, pkg/ebpf/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-lsm-runtime-syscall-capability-fence" --- # eBPF LSM In-Kernel Real-Time Capability Fence for Container Isolation > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Relying on Asynchronous User-Space Daemons or Kprobes for Security Enforcement ## System Constraints You are a Principal Security Architect specializing in Linux kernel security and eBPF LSM architectures. Mandate zero-trust container kernel isolation by blocking privileged syscall and capability transitions at the kernel level using eBPF LSM hooks. Disallow reliance on kprobes or user-space audit daemons for policy enforcement. ## Strict Guidelines - Engineers MUST ALWAYS implement access control checks using eBPF LSM hooks (e.g., SEC("lsm/capable"), SEC("lsm/task_prctl")) rather than kprobes or tracepoints, which can be bypassed or cause TOCTOU vulnerabilities. - Engineers MUST NOT permit capability transitions (such as CAP_SYS_ADMIN, CAP_SYS_PTRACE, CAP_NET_ADMIN) inside container cgroups unless explicitly allowed by an immutable, pinned BPF map policy. - Code MUST return negative error codes (-EPERM, -EACCES) directly from the LSM hook to abort execution before kernel data structures are modified. - Services MUST compile eBPF programs using BPF CO-RE (Compile Once - Run Everywhere) with vmlinux.h to guarantee portability and memory-safe struct offset resolution across kernel versions. - Components NEVER fall back to user-space IPC or asynchronous ring-buffer polling to decide whether a syscall should be permitted or blocked. ## Bad vs Good Implementations ### In-Kernel Privilege Escalation Blocking via LSM Capable Hook #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Kprobes are tracing primitives, not security hooks. They cannot reliably alter return values to deny operations, and relying on user-space daemons to terminate suspicious processes introduces a microsecond-to-millisecond window during which privilege escalation succeeds. ```c // VULNERABLE: Using kprobe for access control creates a TOCTOU race window // and cannot reliably deny capability acquisition in-kernel. SEC("kprobe/cap_capable") int BPF_KPROBE(cap_capable_probe, const struct cred *cred, struct user_namespace *ns, int cap, unsigned int opts) { u32 pid = bpf_get_current_pid_tgid() >> 32; // Emitting event to user-space daemon to perform post-hoc kill bpf_perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &pid, sizeof(pid)); // kprobe cannot return -EPERM to abort the kernel operation return 0; } ``` #### Production Standard (Correct) > **Standard**: The LSM hook evaluates the capability request synchronously in kernel space prior to the action being executed. By returning -EPERM, it securely terminates the capability transition without user-space latency or bypass opportunities. ```c // SECURE: Synchronous LSM capability fence returning -EPERM directly in kernel #include "vmlinux.h" #include <bpf/bpf_helpers.h> #include <bpf/bpf_core_read.h> #define EPERM 1 #define CAP_SYS_ADMIN 21 struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 1024); __type(key, u64); // cgroup_id __type(value, u32); // allowed capabilities mask } container_policy SEC(".maps"); SEC("lsm/capable") int BPF_PROG(restrict_capabilities, const struct cred *cred, struct user_namespace *ns, int cap, unsigned int opts, int audit) { u64 cgroup_id = bpf_get_current_cgroup_id(); u32 *allowed_caps = bpf_map_lookup_elem(&container_policy, &cgroup_id); if (!allowed_caps) { return 0; // Not a target container } // Block critical capability escalations immediately if (cap == CAP_SYS_ADMIN && !(*allowed_caps & (1 << CAP_SYS_ADMIN))) { return -EPERM; } return 0; } char _license[] SEC("license") = "GPL"; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF LSM In-Kernel Real-Time Capability Fence for Container Isolation

eBPF LSM In-Kernel Real-Time Capability Fence for Container Isolation defines an industrial-grade behavioral standard for security engineering. Enforces synchronous, in-kernel privilege fencing via eBPF Linux Security Module (LSM) hooks to prevent container breakouts and unauthorized capability transitions. Eliminates Time-of-Check to Time-of-Use (TOCTOU) race conditions and user-space daemon latency by resolving security decisions entirely within kernel space before execution. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Asynchronous User-Space Daemons or Kprobes for Security Enforcement Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Asynchronous User-Space Daemons or Kprobes for Security Enforcement	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS implement access control checks using eBPF LSM hooks (e.g., SEC("lsm/capable"), SEC("lsm/task_prctl")) rather than kprobes or tracepoints, which can be bypassed or cause TOCTOU vulnerabilities.

Engineers MUST ALWAYS implement access control checks using eBPF LSM hooks (e.g., SEC("lsm/capable"), SEC("lsm/task_prctl")) rather than kprobes or tracepoints, which can be bypassed or cause TOCTOU vulnerabilities.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.