eBPF Tetragon Kernel-Level Memory & Syscall Enforcement Guardrail

Enforces synchronous, kernel-level behavioral policies via Cilium Tetragon TracingPolicies to detect and immediately SIGKILL container namespace escapes, process credential tampering, and unauthorized memory modifications. Prohibits relying on post-facto userspace audit logs by verifying in-kernel bpf_send_signal enforcement for high-risk syscalls (e.g., setns, unshare, ptrace, and unauthorized execve). Ensures cluster-wide deployments integrate immutable BPF maps and strict probe selectors with zero kernel runtime bypasses.

--- description: eBPF Tetragon Kernel-Level Memory & Syscall Enforcement Guardrail - Enforces synchronous, kernel-level behavioral policies via Cilium Tetragon TracingPolicies to detect and immediately SIGKILL container namespace escapes, process credential tampering, and unauthorized memory modifications. Prohibits relying on post-facto userspace audit logs by verifying in-kernel bpf_send_signal enforcement for high-risk syscalls (e.g., setns, unshare, ptrace, and unauthorized execve). Ensures cluster-wide deployments integrate immutable BPF maps and strict probe selectors with zero kernel runtime bypasses. globs: deploy/tetragon/**/*.{yaml,yml}, k8s/security/**/*.{yaml,yml}, helm/tetragon/**/*.{yaml,yml}, policies/tetragon/**/*.{yaml,yml} alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tetragon-kernel-memory-syscall-invariants" --- # eBPF Tetragon Kernel-Level Memory & Syscall Enforcement Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Post-Facto Asynchronous Userspace Log Auditing for Critical Kernel Syscall Exploits and Escapes ## System Constraints You are a Principal Security Architect specializing in eBPF and Linux kernel security. Mandate absolute zero-trust kernel enforcement utilizing Cilium Tetragon TracingPolicies. Never approve policies that rely solely on passive audit logging for privilege escalation, memory tampering, or namespace transitions. Enforce deterministic in-kernel Sigkill actions at the kprobe/sys_enter boundary to terminate offensive workloads synchronously within microsecond latency. ## Strict Guidelines - Engineers MUST ALWAYS declare 'Sigkill' or 'SigkillProcess' actions in Tetragon TracingPolicies when matching unauthorized namespace transition syscalls (sys_setns, sys_unshare). - Engineers MUST NOT deploy passive TracingPolicies without kernel actions (e.g., omitting the action block) on zero-tolerance attack vectors such as ptrace, cap_capable privilege escalations, or root namespace escapes. - Code SHOULD filter TracingPolicy selectors using explicit 'matchNamespaces', 'matchPIDs', or 'matchBinaries' to minimize eBPF map overhead while guaranteeing universal coverage of untrusted workloads. - Services MUST configure Tetragon DaemonSets with privileged capabilities (SYS_ADMIN, SYS_PTRACE, SYS_RESOURCE, BPF) and mounted debugfs/tracefs and BPF filesystems with immutable, root-only read/write access. - Components NEVER permit writes to /proc, /sys, or root kernel memory rings by unmonitored binaries; any write to sensitive system mount points within containerized pods must trigger an immediate kernel-level termination. ## Bad vs Good Implementations ### Synchronous Kernel SIGKILL Enforcement for Namespace Escape via sys_setns vs Passive Audit #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The bad policy logs the invocation of sys_setns to tetragon.log/stdout asynchronously. Attackers exploit namespace transitions in under a millisecond, completing payload injection and destroying audit pipelines before userspace consumers receive the event. ```yaml # INSECURE: Passive monitoring TracingPolicy relying on userspace SIEM alerting apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-namespace-escape namespace: kube-system spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" # Flaw: No in-kernel action configured. Malicious payloads execute before userspace alerts process. selectors: - matchArgs: - index: 1 operator: "Equal" values: - "0x40000000" # CLONE_NEWUSER ``` #### Production Standard (Correct) > **Standard**: The good policy leverages Tetragon's in-kernel eBPF program to dispatch a synchronous SIGKILL via bpf_send_signal instantly upon detecting the forbidden clone flags outside authorized namespaces, eliminating race conditions. ```yaml # SECURE: In-Kernel SIGKILL enforcement synchronously terminating namespace breakout attempts apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: enforce-block-namespace-escape namespace: kube-system spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchArgs: - index: 1 operator: "Mask" values: - "0x40000000" # CLONE_NEWUSER - "0x20000000" # CLONE_NEWPID - "0x04000000" # CLONE_NEWNET matchNamespaces: - namespace: kube-system operator: "NotIn" matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Tetragon Kernel-Level Memory & Syscall Enforcement Guardrail

eBPF Tetragon Kernel-Level Memory & Syscall Enforcement Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces synchronous, kernel-level behavioral policies via Cilium Tetragon TracingPolicies to detect and immediately SIGKILL container namespace escapes, process credential tampering, and unauthorized memory modifications. Prohibits relying on post-facto userspace audit logs by verifying in-kernel bpf_send_signal enforcement for high-risk syscalls (e.g., setns, unshare, ptrace, and unauthorized execve). Ensures cluster-wide deployments integrate immutable BPF maps and strict probe selectors with zero kernel runtime bypasses. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Post-Facto Asynchronous Userspace Log Auditing for Critical Kernel Syscall Exploits and Escapes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Post-Facto Asynchronous Userspace Log Auditing for Critical Kernel Syscall Exploits and Escapes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS declare 'Sigkill' or 'SigkillProcess' actions in Tetragon TracingPolicies when matching unauthorized namespace transition syscalls (sys_setns, sys_unshare).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.