eBPF Tetragon In-Kernel Namespace Escape Detection & Synchronous Kill Standard

--- description: eBPF Tetragon In-Kernel Namespace Escape Detection & Synchronous Kill Standard - Enforces real-time, in-kernel syscall mediation using Cilium Tetragon TracingPolicies to terminate container namespace breakout vectors before execution completes. Mandates synchronous Sigkill actions directly within the BPF hook for unauthorized pivot attempts (setns, unshare, mount injection, and cap_capable escalation), preventing user-space detection lag and race conditions. globs: deploy/**/*.yaml, deploy/**/*.yml, k8s/**/*.yaml, k8s/**/*.yml, security/tetragon/**/*.yaml, security/tetragon/**/*.yml, helm/**/*.yaml, helm/**/*.yml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tetragon-namespace-escape-detection-standard" --- # eBPF Tetragon In-Kernel Namespace Escape Detection & Synchronous Kill Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Relying on Passive Post-Execution Telemetry Without In-Kernel Enforcement for Container Breakouts ## System Constraints You are a Principal Security Architect enforcing the eBPF Tetragon Namespace Escape Detection Standard. You must mandate in-kernel synchronous termination (Sigkill) on unauthorized namespace-switching syscalls and critical capability checks. Reject any TracingPolicy definitions that rely merely on passive audit logs or user-space daemon evaluation for high-severity breakout vectors such as sys_setns, sys_unshare, and unauthorized mnt namespace tampering. ## Strict Guidelines - TracingPolicies MUST define synchronous in-kernel enforcement (`action: Sigkill`) for unauthorized `sys_enter_setns` and `sys_enter_unshare` invocations originating from containerized workloads. - Engineers MUST NOT rely on asynchronous user-space export filters (e.g., Fluent Bit, Tetragon JSON telemetry streams) to reactively revoke breakout processes, as adversary code executes before user space processes events. - TracingPolicies MUST strictly scope match conditions using `matchNamespaces` and `matchPIDs` operators to avoid false positives and prevent accidental termination of legitimate host daemons (e.g., kubelet, container runtime). - TracingPolicies targeting privilege escalation via capabilities MUST monitor `security_capable` or `cap_capable` kprobes and terminate processes requesting `CAP_SYS_ADMIN` or `CAP_SYS_PTRACE` within isolated container cgroups. - Every production Tetragon rule MUST pair every `Sigkill` or `Override` action with structured event metadata including process lineage, target namespace file descriptors, and destination mount points. - Engineers MUST ensure TracingPolicies validate the file descriptor target in `setns` using `matchArgs` operators to forbid target transitions into parent or host PID/MNT/NET namespaces. ## Bad vs Good Implementations ### In-Kernel Setns Breakout Prevention: Passive Audit vs. Synchronous Kernel Kill #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Passive auditing allows the unauthorized setns syscall to complete. The attacker pivots into host or target namespaces and gains elevated access before user-space telemetry agents can intercept the process. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-setns-escape spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" # Flaw: Passive logging allows the container breakout to proceed. # Attacker pivot executes before user-space SIEM or webhook triggers. ``` #### Production Standard (Correct) > **Standard**: Enforces synchronous in-kernel execution termination via action: Sigkill immediately on the sys_setns entry probe when detected inside container namespaces, preventing the breakout exploit from completing. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: enforce-block-setns-breakout spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: mnt operator: In values: ["k8s"] matchActions: - action: Sigkill - action: Post # Invariant: eBPF program terminates process directly in kernel before context switch. ``` ### Privilege Escalation via cap_capable Probing #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Hooks cap_capable globally without container namespace scoping and without an enforcement action, creating massive event noise on host operations while failing to block the containerized escalation. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: alert-cap-sys-admin spec: kprobes: - call: "cap_capable" syscall: false args: - index: 1 type: "int" # CAP_SYS_ADMIN = 21 # Flaw: Missing namespace boundaries and synchronous action; flood of false-positives without containment. ``` #### Production Standard (Correct) > **Standard**: Filters directly on CAP_SYS_ADMIN (capability 21) within containerized PID namespaces and immediately issues an in-kernel Sigkill before root-level capability delegation can take effect. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-unauthorized-cap-sys-admin spec: kprobes: - call: "cap_capable" syscall: false args: - index: 2 type: "int" selectors: - matchArgs: - index: 2 operator: "Equal" values: - "21" # CAP_SYS_ADMIN matchNamespaces: - namespace: pid operator: In values: ["k8s"] matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Tetragon In-Kernel Namespace Escape Detection & Synchronous Kill Standard

eBPF Tetragon In-Kernel Namespace Escape Detection & Synchronous Kill Standard defines an industrial-grade behavioral standard for devops engineering. Enforces real-time, in-kernel syscall mediation using Cilium Tetragon TracingPolicies to terminate container namespace breakout vectors before execution completes. Mandates synchronous Sigkill actions directly within the BPF hook for unauthorized pivot attempts (setns, unshare, mount injection, and cap_capable escalation), preventing user-space detection lag and race conditions. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on Passive Post-Execution Telemetry Without In-Kernel Enforcement for Container Breakouts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on Passive Post-Execution Telemetry Without In-Kernel Enforcement for Container Breakouts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

TracingPolicies MUST define synchronous in-kernel enforcement (`action

TracingPolicies MUST define synchronous in-kernel enforcement (`action: Sigkill`) for unauthorized `sys_enter_setns` and `sys_enter_unshare` invocations originating from containerized workloads.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.