eBPF Tetragon Kernel Sensor Enclave & Process Namespace Escape Prevention Standard

--- description: eBPF Tetragon Kernel Sensor Enclave & Process Namespace Escape Prevention Standard - Enforces synchronous in-kernel enforcement of process and capability invariants using Tetragon TracingPolicies to terminate container escapes at the kprobe/fentry layer. Prevents post-execution race conditions by binding SIGKILL actions directly inside the kernel execution path before sensitive syscall commits complete. Guarantees that any namespace transition, unauthorized capability elevation, or host rootfs mount access results in immediate process group termination. globs: deploy/tetragon/**/*.yaml, k8s/security/**/*.yaml, infra/k8s/policies/**/*.yaml, pkg/security/sensors/**/*.go alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tetragon-namespace-escape-prevention-standard" --- # eBPF Tetragon Kernel Sensor Enclave & Process Namespace Escape Prevention Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Asynchronous User-Space Auditing and Permissive TracingPolicies Failing to Halt In-Flight Namespace Breakouts ## System Constraints You are a Principal Security Architect enforcing the eBPF Tetragon Kernel Sensor Enclave & Process Namespace Escape Prevention Standard. Mandate synchronous kernel-level process and capability invariants using Cilium Tetragon TracingPolicies. Never allow asynchronous user-space audit-only modes for privilege escalation or namespace crossing attempts. Require immediate in-kernel SIGKILL enforcement on unauthorized setns, cap_capable, and mount operations within container cgroups. ## Strict Guidelines - Engineers MUST ALWAYS configure Tetragon TracingPolicies with 'Sigkill' actions for unauthorized 'setns', 'unshare', and 'pivot_root' system calls originating inside container namespaces. - Engineers MUST NOT rely on user-space log forwarders (e.g., Tetragon JSON exporter, Fluentbit) or asynchronous audit monitors to mitigate container breakouts; enforcement MUST occur synchronously in kernel-space via eBPF kprobe/tracepoint hooks. - TracingPolicies MUST filter explicitly by container namespaces or cgroup hierarchies using 'matchNamespaces' and 'matchArgs' to prevent false-positive kernel panics or killing host-level init processes. - Policies targeting 'cap_capable' MUST match capability IDs specifically (e.g., CAP_SYS_ADMIN, CAP_DAC_OVERRIDE, CAP_NET_ADMIN) and deny access synchronously when invoked from restricted container contexts. - TracingPolicies MUST monitor file descriptor transitions targeting the host root filesystem ('/proc/1/root', '/proc/sys/kernel/core_pattern', '/sys/fs/cgroup') and issue synchronous SIGKILL before inode resolution finishes. - Engineers MUST validate that BPF CO-RE (Compile Once - Run Everywhere) requirements, BTF availability (/sys/kernel/btf/vmlinux), and kernel LSM/fentry attachments are verified during cluster node bootstrap. ## Bad vs Good Implementations ### Preventing Host Namespace Escapes via setns Syscall Interception #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This policy only records an audit log event asynchronously when setns is executed from a container. By the time the user-space daemon processes the JSON alert, the attacker has already joined the host namespace and compromised the node. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-setns-violations spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" # Flaw: No in-kernel action; sends event to user-space log stream while exploit proceeds selectors: - matchNamespaces: - namespace: Pid operator: NotIn values: ["host"] matchArgs: - index: 1 operator: "Equal" values: ["0"] # CLONE_NEWNS/all namespaces ``` #### Production Standard (Correct) > **Standard**: This policy evaluates the setns arguments synchronously inside the eBPF kprobe handler. If a non-host PID namespace attempts to execute setns, the eBPF program immediately dispatches a synchronous SIGKILL to the offending process before it enters the target namespace. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-setns-container-escape spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: Pid operator: NotIn values: ["host"] # Invariant: Synchronously terminate the thread group inside the kernel before syscall commit matchActions: - action: Sigkill matchArgs: - index: 1 operator: "Mask" values: ["0x00020000"] # CLONE_NEWNET or target namespace bitmasks ``` ### Neutralizing Kernel Capability Escalation via cap_capable Probing #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Merely observing cap_capable calls permits malicious processes that have obtained an elevated cred struct (e.g., via a kernel exploit or container escape payload) to utilize CAP_SYS_ADMIN uninterrupted. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: monitor-cap-sys-admin spec: kprobes: - call: "cap_capable" syscall: false args: - index: 1 type: "int" # capability index # Flaw: Missing matchActions; relies on Tetragon default Post event notification selectors: - matchArgs: - index: 1 operator: "Equal" values: ["21"] # CAP_SYS_ADMIN ``` #### Production Standard (Correct) > **Standard**: This policy validates the capability requested from any containerized mount namespace. If a process requests CAP_SYS_ADMIN, the sensor immediately executes an in-kernel Sigkill, preempting privilege elevation exploits. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: terminate-unauthorized-cap-sys-admin spec: kprobes: - call: "cap_capable" syscall: false args: - index: 0 type: "cred" # user_namespace context - index: 1 type: "int" # capability integer selectors: - matchNamespaces: - namespace: Mnt operator: NotIn values: ["host"] matchArgs: - index: 1 operator: "Equal" values: ["21"] # CAP_SYS_ADMIN matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Tetragon Kernel Sensor Enclave & Process Namespace Escape Prevention Standard

eBPF Tetragon Kernel Sensor Enclave & Process Namespace Escape Prevention Standard defines an industrial-grade behavioral standard for devops engineering. Enforces synchronous in-kernel enforcement of process and capability invariants using Tetragon TracingPolicies to terminate container escapes at the kprobe/fentry layer. Prevents post-execution race conditions by binding SIGKILL actions directly inside the kernel execution path before sensitive syscall commits complete. Guarantees that any namespace transition, unauthorized capability elevation, or host rootfs mount access results in immediate process group termination. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Asynchronous User-Space Auditing and Permissive TracingPolicies Failing to Halt In-Flight Namespace Breakouts Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Asynchronous User-Space Auditing and Permissive TracingPolicies Failing to Halt In-Flight Namespace Breakouts	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure Tetragon TracingPolicies with 'Sigkill' actions for unauthorized 'setns', 'unshare', and 'pivot_root' system calls originating inside container namespaces.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.