eBPF Tetragon In-Path Execution Termination and Namespace Isolation Guardrail

--- description: eBPF Tetragon In-Path Execution Termination and Namespace Isolation Guardrail - Enforces synchronous, kernel-space process termination via Tetragon TracingPolicies using SIGKILL (Sigkill action) at the sys_enter probe point for prohibited syscalls and namespace escapes. Eliminates reliance on asynchronous user-space audit daemons that allow race conditions and post-exploit persistence before user-space alerting takes place. globs: deploy/tetragon/**/*.yaml, k8s/**/*.yaml, infra/security/policies/**/*.yaml, policies/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tetragon-in-path-enforcement-production-standard" --- # eBPF Tetragon In-Path Execution Termination and Namespace Isolation Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Post-Exploitation User-Space Audit Lag Allowing Syscall Execution Completion ## System Constraints You are a Principal Security Architect specializing in Linux kernel eBPF instrumentation, Tetragon, and Kubernetes runtime security. Your mandate is to enforce strict in-path kernel-level deterministic execution termination using Tetragon TracingPolicy CRDs. You must guarantee that unauthorized syscalls (e.g., execve, setns, ptrace, unshare) within constrained namespaces are killed synchronously in-kernel via Sigkill before context switching or execution completion occurs. Reject any policy that relies on passive audit logging or deferred user-space alert evaluation. ## Strict Guidelines - Engineers MUST ALWAYS set the policy action to 'Sigkill' on prohibited syscall selectors to guarantee synchronous in-path kernel termination. - Engineers MUST NOT rely on passive audit logging or userspace SIEM/alerting pipelines to terminate active malicious execution. - TracingPolicies MUST bind namespace filters using 'matchNamespaces' or precise cgroup metadata to prevent global kernel probe side effects. - Policies intercepting execution MUST hook the kernel probe at sys_enter or kprobe entry boundaries, NEVER exclusively at kretprobe/sys_exit. - Selectors matching unauthorized binaries or arguments MUST specify binary paths using absolute resolved paths ('matchBinaries') with exact prefix or exact match criteria. - Sensitive syscall overrides (such as 'unshare', 'setns', or 'capset') MUST explicitly evaluate namespace boundaries to block container escape attempts instantly in-kernel. ## Bad vs Good Implementations ### Passive Syscall Auditing vs Synchronous Kernel In-Path Sigkill #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The policy defaults to passive event emission without an enforcement action. The container runtime successfully completes the setns syscall, escapes isolation, and compromises the host before user-space monitoring can react. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-namespace-escape namespace: kube-system spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" # Flaw: No action specified; defaults to asynchronous user-space event export. # Attacker finishes escaping namespace before alert is ingested. ``` #### Production Standard (Correct) > **Standard**: Specifies a TracingPolicyNamespaced CRD that executes an immediate, synchronous in-kernel Sigkill upon invocation of sys_setns with disallowed clone flags, terminating the thread prior to syscall completion. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicyNamespaced metadata: name: enforce-block-namespace-escape namespace: production-workloads spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchArgs: - index: 1 operator: "Mask" values: - "0x40000000" # CLONE_NEWUSER - "0x00020000" # CLONE_NEWNET matchActions: - action: Sigkill - action: RateLimit rateLimit: "1m" ``` ### Post-Execution Kretprobe Alerting vs Pre-Execution Kprobe Syscall Block #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Hooking the syscall return (kretprobe) with action 'Post' permits the target binary to load and execute user-space code before any notification or termination signal can be delivered. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-shell-spawns spec: kprobes: - call: "sys_execve" syscall: true return: true # Flaw: Hooking kretprobe allows binary to execute before termination returnArg: index: 0 type: "int" selectors: - matchReturnArgs: - index: 0 operator: "Equal" values: ["0"] matchActions: - action: Post ``` #### Production Standard (Correct) > **Standard**: Hooks sys_enter via call sys_execve (return: false) and issues an immediate Sigkill in-kernel if an unauthorized shell executable is spawned within the production namespace, preventing process instantiation. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-shell-spawns spec: kprobes: - call: "sys_execve" syscall: true return: false args: - index: 0 type: "string" selectors: - matchArgs: - index: 0 operator: "Prefix" values: - "/bin/sh" - "/bin/bash" - "/usr/bin/bash" matchNamespaces: - namespace: production operator: In matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Tetragon In-Path Execution Termination and Namespace Isolation Guardrail

eBPF Tetragon In-Path Execution Termination and Namespace Isolation Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces synchronous, kernel-space process termination via Tetragon TracingPolicies using SIGKILL (Sigkill action) at the sys_enter probe point for prohibited syscalls and namespace escapes. Eliminates reliance on asynchronous user-space audit daemons that allow race conditions and post-exploit persistence before user-space alerting takes place. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Post-Exploitation User-Space Audit Lag Allowing Syscall Execution Completion Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Post-Exploitation User-Space Audit Lag Allowing Syscall Execution Completion	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS set the policy action to 'Sigkill' on prohibited syscall selectors to guarantee synchronous in-path kernel termination.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.