eBPF Tetragon In-Kernel Real-Time Syscall Anomaly and Escape Mitigation

Enforces synchronous in-kernel zero-trust security postures using Cilium Tetragon TracingPolicies with SIGKILL enforcement actions. Mandates that namespace boundary escapes, privilege escalations, and unapproved kernel sockets are intercepted and terminated directly within eBPF probe execution paths before reaching userland context. Prevents asynchronous race conditions where attackers execute arbitrary code or establish command-and-control channels prior to userland agent telemetry processing.

--- description: eBPF Tetragon In-Kernel Real-Time Syscall Anomaly and Escape Mitigation - Enforces synchronous in-kernel zero-trust security postures using Cilium Tetragon TracingPolicies with SIGKILL enforcement actions. Mandates that namespace boundary escapes, privilege escalations, and unapproved kernel sockets are intercepted and terminated directly within eBPF probe execution paths before reaching userland context. Prevents asynchronous race conditions where attackers execute arbitrary code or establish command-and-control channels prior to userland agent telemetry processing. globs: deploy/tetragon/**/*.yaml, deploy/tetragon/**/*.yml, k8s/**/*.yaml, helm/tetragon/**/*.yaml, security/policies/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tetragon-kernel-anomaly-enforcement" --- # eBPF Tetragon In-Kernel Real-Time Syscall Anomaly and Escape Mitigation > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Relying on Asynchronous Userland Telemetry or Audit-Only Filters for Container Escape and Socket Enforcements ## System Constraints You are a Principal Security Architect specializing in Linux kernel security and Cilium Tetragon runtime enforcement. You ensure that all runtime defense policies implement synchronous in-kernel enforcement (SIGKILL/override) rather than passive asynchronous log generation. You rigorously enforce the isolation of container namespaces (mnt, pid, net) via kprobes, tracepoints, and LSM hooks on syscalls like sys_enter_setns, sys_enter_unshare, and sys_enter_connect, preventing zero-day kernel breakouts and illicit egress. ## Strict Guidelines - TracingPolicies MUST ALWAYS specify 'Sigkill' actions on unauthorized namespace alterations, privilege changes, and critical binary invocations. - Security engineers MUST NOT deploy audit-only policies in production when mitigating deterministic namespace escapes (e.g., setns, unshare, pivot_root). - Network enforcement policies MUST hook kernel functions like tcp_connect or __sys_connect directly to terminate unauthorized egress synchronously in the kernel. - Policies MUST define precise matchArgs and matchNamespaces conditions to avoid false positives and prevent accidental denial-of-service on host daemonsets. - Tetragon configurations MUST enable BPF LSM programs when kernel version (>= 5.7) supports it, to achieve non-bypassable syscall hook points over standard kprobes. ## Bad vs Good Implementations ### Tetragon TracingPolicy: In-Kernel Namespace Escape Termination vs Audit Logging #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Passive audit policies permit an attacker to complete the setns syscall and achieve container breakout. By the time userland agents receive and parse the event, process memory is already compromised. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-namespace-escape namespace: kube-system spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" # Flaw: Missing 'Sigkill' action. Only logs an event asynchronously to Tetragon userland, # allowing the hostile payload to switch namespaces and execute rootkit binaries. ``` #### Production Standard (Correct) > **Standard**: Synchronously attaches an eBPF kprobe that evaluates the requested clone namespace flags. If an unauthorized container attempts to switch mnt, net, or pid namespaces, the kernel synchronously terminates the offending process with SIGKILL before syscall completion. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-namespace-escape namespace: kube-system spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: default operator: In matchArgs: - index: 1 operator: "Mask" values: - "0x00020000" # CLONE_NEWNET - "0x00040000" # CLONE_NEWPID - "0x00080000" # CLONE_NEWNS matchActions: - action: Sigkill ``` ### Tetragon TracingPolicy: In-Kernel Network Socket Egress Denial #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Merely listening to tcp_connect events without a drop or Sigkill action permits immediate SYN packet dispatch and data exfiltration before external firewalls or log processors can react. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: log-unauthorized-egress spec: kprobes: - call: "tcp_connect" syscall: false args: - index: 0 type: "sock" # Flaw: No synchronous termination allows dynamic reverse shells to finalize TCP handshake ``` #### Production Standard (Correct) > **Standard**: Instantly terminates rogue processes attempting outbound connections to prohibited egress ports directly in kernel space during the socket connection initialization. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: enforce-block-unauthorized-egress spec: kprobes: - call: "tcp_connect" syscall: false args: - index: 0 type: "sock" selectors: - matchNamespaces: - namespace: payment-processing operator: In matchArgs: - index: 0 operator: "DPort" values: - "4444" # Common reverse shell ports - "1337" - "6667" matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Tetragon In-Kernel Real-Time Syscall Anomaly and Escape Mitigation

eBPF Tetragon In-Kernel Real-Time Syscall Anomaly and Escape Mitigation defines an industrial-grade behavioral standard for devops engineering. Enforces synchronous in-kernel zero-trust security postures using Cilium Tetragon TracingPolicies with SIGKILL enforcement actions. Mandates that namespace boundary escapes, privilege escalations, and unapproved kernel sockets are intercepted and terminated directly within eBPF probe execution paths before reaching userland context. Prevents asynchronous race conditions where attackers execute arbitrary code or establish command-and-control channels prior to userland agent telemetry processing. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Asynchronous Userland Telemetry or Audit-Only Filters for Container Escape and Socket Enforcements Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Asynchronous Userland Telemetry or Audit-Only Filters for Container Escape and Socket Enforcements	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

TracingPolicies MUST ALWAYS specify 'Sigkill' actions on unauthorized namespace alterations, privilege changes, and critical binary invocations.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.