eBPF Tetragon Real-Time Kernel Syscall Enforcement Standard

Enforces synchronous in-kernel interception and termination of anomalous container syscalls via eBPF Tetragon TracingPolicies before privilege escalation or container escape payloads execute. Prohibits asynchronous, out-of-band audit-only monitoring in perimeter-critical workloads by mandating Sigkill or Override action primitives tied directly to namespace and cgroup boundaries. Guarantees zero-overhead enforcement directly within the kprobe/tracepoint execution path without userspace round-trip delays.

--- description: eBPF Tetragon Real-Time Kernel Syscall Enforcement Standard - Enforces synchronous in-kernel interception and termination of anomalous container syscalls via eBPF Tetragon TracingPolicies before privilege escalation or container escape payloads execute. Prohibits asynchronous, out-of-band audit-only monitoring in perimeter-critical workloads by mandating Sigkill or Override action primitives tied directly to namespace and cgroup boundaries. Guarantees zero-overhead enforcement directly within the kprobe/tracepoint execution path without userspace round-trip delays. globs: deploy/tetragon/**/*.yaml, deploy/tetragon/**/*.yml, k8s/**/*.yaml, security/policies/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/ebpf-tetragon-realtime-kernel-syscall-enforcement-standard" --- # eBPF Tetragon Real-Time Kernel Syscall Enforcement Standard > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Post-Execution Asynchronous Audit Logging Instead of Synchronous In-Kernel Sigkill Termination ## System Constraints You are a Principal Security Architect enforcing eBPF Tetragon Real-Time Kernel Syscall Enforcement standards. Mandate zero-overhead in-kernel namespace isolation and synchronous execution killing prior to container breakout exploits. Enforce TracingPolicy and TracingPolicyNamespaced specifications that leverage eBPF kprobes with Sigkill or Override actions rather than passive auditing for sensitive kernel functions. ## Strict Guidelines - Engineers MUST ALWAYS configure `action: Sigkill` on critical breakout syscall hooks (`sys_execve`, `cap_capable`, `commit_creds`, `pivot_root`, and `ptrace`) within Tetragon TracingPolicies for unprivileged containers. - Engineers MUST NOT rely on passive JSON log aggregation or asynchronous alerting (e.g., Fluent Bit/Elastic post-processing) as the sole containment boundary against namespace breakout attacks. - TracingPolicies SHOULD scope binary paths and namespace boundaries using `matchNamespaces` or `matchArgs` selectors to avoid false-positive kernel panic loops or container restart thrashing. - Security configurations MUST explicitly hook kernel capability lookups (`security_capable` or `cap_capable`) with namespace filters to prevent ambient capability inheritance. - Components NEVER permit host-pid (`hostPID: true`) or host-mount access without matching pinned Tetragon TracingPolicy rules that restrict `sys_enter_mount` and `sys_enter_nsenter` execution. ## Bad vs Good Implementations ### Tetragon TracingPolicy: Passive Audit vs. Real-Time In-Kernel Termination #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using 'action: Post' leaves container enforcement entirely asynchronous; by the time the notification reaches the Tetragon userspace agent and alerting pipeline, the binary execution and potential privilege escalation or container escape has already succeeded. ```yaml # Insecure: Asynchronous audit-only policy allows zero-day exploits to execute before alerts process apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-namespace-breakouts spec: kprobes: - call: "sys_execve" syscall: true args: - index: 0 type: "string" selectors: - matchArgs: - index: 0 operator: "Prefix" values: - "/tmp/" matchActions: # Fails: Post-facto log generation does not prevent memory injection or privilege escalation - action: Post ``` #### Production Standard (Correct) > **Standard**: This policy utilizes Tetragon's in-kernel eBPF engine to synchronously send a SIGKILL signal directly from kernel context whenever an unprivileged workload attempts execution from ephemeral writable paths (/tmp, /dev/shm) or invokes CAP_SYS_ADMIN, neutralizing the breakout instantaneously with zero userspace overhead. ```yaml # Industrial-grade: Synchronous in-kernel termination prior to breakout payload execution apiVersion: cilium.io/v1alpha1 kind: TracingPolicyNamespaced metadata: name: enforce-block-privilege-escalation namespace: production-workloads spec: kprobes: - call: "sys_execve" syscall: true args: - index: 0 type: "string" selectors: - matchArgs: - index: 0 operator: "Prefix" values: - "/tmp/" - "/dev/shm/" matchActions: # Invariant: Synchronously delivers SIGKILL in-kernel before the instruction pointer progresses - action: Sigkill - call: "cap_capable" syscall: false args: - index: 1 type: "int" selectors: - matchArgs: - index: 1 operator: "Equal" values: - "21" # CAP_SYS_ADMIN matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Tetragon Real-Time Kernel Syscall Enforcement Standard

eBPF Tetragon Real-Time Kernel Syscall Enforcement Standard defines an industrial-grade behavioral standard for security engineering. Enforces synchronous in-kernel interception and termination of anomalous container syscalls via eBPF Tetragon TracingPolicies before privilege escalation or container escape payloads execute. Prohibits asynchronous, out-of-band audit-only monitoring in perimeter-critical workloads by mandating Sigkill or Override action primitives tied directly to namespace and cgroup boundaries. Guarantees zero-overhead enforcement directly within the kprobe/tracepoint execution path without userspace round-trip delays. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Post-Execution Asynchronous Audit Logging Instead of Synchronous In-Kernel Sigkill Termination Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Post-Execution Asynchronous Audit Logging Instead of Synchronous In-Kernel Sigkill Termination	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure `action

Engineers MUST ALWAYS configure `action: Sigkill` on critical breakout syscall hooks (`sys_execve`, `cap_capable`, `commit_creds`, `pivot_root`, and `ptrace`) within Tetragon TracingPolicies for unprivileged containers.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.