eBPF Tetragon In-Kernel Syscall Quarantine & Namespace Isolation Standard

--- description: eBPF Tetragon In-Kernel Syscall Quarantine & Namespace Isolation Standard - Mandates deterministic, in-kernel enforcement using Tetragon TracingPolicy resources with synchronous Sigkill actions rather than asynchronous userspace alert pipelines. Eliminates time-of-check to time-of-use (TOCTOU) race conditions during container escapes, privilege escalations, and unauthorized namespace traversals. globs: **/*.yaml, **/*.yml, policies/**/*.yaml, deploy/tetragon/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tetragon-kernel-syscall-quarantine-standard" --- # eBPF Tetragon In-Kernel Syscall Quarantine & Namespace Isolation Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Relying on Userspace Audit Collectors and Asynchronous Alerts for Container Escape Syscalls ## System Constraints You are a Principal Security Architect enforcing the eBPF Tetragon Kernel-Level Syscall Quarantine Standard. You mandate synchronous, in-kernel deterministic security controls. Reject any architecture that defers critical syscall containment (e.g., setns, unshare, pivot_root, commit_creds) to userspace audit loops or post-execution detection. Enforce Tetragon TracingPolicy specifications that operate directly at the BPF probe boundary with immediate kill actions. ## Strict Guidelines - Engineers MUST ALWAYS declare Tetragon TracingPolicy or TracingPolicyNamespaced CRDs with synchronous in-kernel termination (e.g., 'action: Sigkill') on sensitive syscalls. - Engineers MUST NOT configure passive observation actions (e.g., 'action: Post') without in-kernel quarantine for namespace manipulation syscalls ('sys_enter_setns', 'sys_enter_unshare', 'sys_enter_pivot_root'). - TracingPolicies MUST bind filters directly to namespace metadata, capability masks, and binary execution paths to eliminate kernel ring-buffer overhead. - Engineers MUST verify BPF Type Format (BTF) availability and probe compatibility for target kernel versions (v5.4+) to prevent failed policy attachments. - Security policies MUST NEVER execute unbounded wildcard argument matching on kernel hook points, preserving deterministic eBPF verifier convergence. ## Bad vs Good Implementations ### In-Kernel Syscall Quarantine vs. Asynchronous Audit Logging #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using 'action: Post' logs the event to the userspace daemon via the perf/ring buffer asynchronously. The kernel executes the 'setns' syscall immediately, allowing the attacker to attach to the host namespace and compromise the node before any userspace agent can react. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-namespace-escape spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchActions: # VULNERABILITY: Asynchronous notification allows syscall completion, # introducing TOCTOU race conditions where escape succeeds before alert ingestion. - action: Post ``` #### Production Standard (Correct) > **Standard**: Attaches directly to the 'sys_setns' entry point. When an untrusted workload attempts namespace switching, the Tetragon eBPF hook immediately delivers SIGKILL directly inside the kernel execution path before the namespace reference is swapped. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: enforce-namespace-quarantine spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: default operator: In matchArgs: - index: 1 operator: "Equal" values: - "0" # CLONE_NEWNS or any foreign namespace descriptor matchActions: # REMEDIATION: Deterministic in-kernel termination instantly halts execution # within the BPF hook, precluding userspace latency and TOCTOU vulnerabilities. - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Tetragon In-Kernel Syscall Quarantine & Namespace Isolation Standard

eBPF Tetragon In-Kernel Syscall Quarantine & Namespace Isolation Standard defines an industrial-grade behavioral standard for security engineering. Mandates deterministic, in-kernel enforcement using Tetragon TracingPolicy resources with synchronous Sigkill actions rather than asynchronous userspace alert pipelines. Eliminates time-of-check to time-of-use (TOCTOU) race conditions during container escapes, privilege escalations, and unauthorized namespace traversals. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Userspace Audit Collectors and Asynchronous Alerts for Container Escape Syscalls Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Userspace Audit Collectors and Asynchronous Alerts for Container Escape Syscalls	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS declare Tetragon TracingPolicy or TracingPolicyNamespaced CRDs with synchronous in-kernel termination (e.g., 'action

Engineers MUST ALWAYS declare Tetragon TracingPolicy or TracingPolicyNamespaced CRDs with synchronous in-kernel termination (e.g., 'action: Sigkill') on sensitive syscalls.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.