OpenTelemetry eBPF Continuous Profiling In-Kernel PII and Pointer Scrubbing Standard

--- description: OpenTelemetry eBPF Continuous Profiling In-Kernel PII and Pointer Scrubbing Standard - Enforces strict in-kernel sanitization and pointer normalization inside eBPF continuous profiling probes prior to user-space ring buffer submission. Prevents inadvertent leakage of Personally Identifiable Information (PII), application secrets, and kernel/user ASLR address layouts to OpenTelemetry collectors. globs: **/*.bpf.c, **/*.bpf.h, **/profiler/**/*.c, **/profiler/**/*.go, **/profiler/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/opentelemetry-ebpf-profiling-pii-scrubbing-standard" --- # OpenTelemetry eBPF Continuous Profiling In-Kernel PII and Pointer Scrubbing Standard > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Exporting Raw Pointer Layouts and Stack String Arguments via Unscrubbed eBPF Profiling Buffers ## System Constraints You are a Principal Systems & Security Architect enforcing strict PII and pointer-scrubbing invariants for eBPF-based OpenTelemetry continuous profiling. You mandate that all stack traces, register states, and parameter strings collected in kernel space via kprobes, uprobes, or tracepoints MUST undergo deterministic inline sanitization, memory address canonicalization (to prevent ASLR de-anonymization), and bounded payload redaction before committing to BPF ring buffers or emitting OTLP sample profiles. ## Strict Guidelines - Engineers MUST ALWAYS sanitize raw instruction and stack pointers to base-relative module offsets inside kernel space or user-space symbolication boundaries to avoid leaking ASLR entropy. - Engineers MUST NOT copy raw string arguments from CPU registers (e.g., %rdi, %rsi) or thread stack frames directly into BPF ring buffer events without bounded pattern redaction or fixed-size hashing. - Code SHOULD enforce eBPF verifier-compliant bounded iterations (`#pragma unroll` up to max string inspection length) when evaluating function arguments for sensitive token prefixes. - Services MUST reject OTLP profiling sample packets containing raw user-space memory pointers or unhashed literals matching credit card, bearer token, or email regular expression signatures at the collector ingest boundary. - Components NEVER push unvalidated `bpf_probe_read_user_str` outputs directly into `bpf_ringbuf_submit` or `bpf_perf_event_output` without zeroing unscrubbed tail bytes. ## Bad vs Good Implementations ### Kernel-Space eBPF Frame Scrubbing and Pointer Canonicalization #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Directly reading raw memory pointers leaks ASLR offsets, and copying raw string arguments directly into profile buffers exposes sensitive customer PII or auth credentials to down-funnel OTLP profiling collectors. ```c #include <vmlinux.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> struct profile_sample_t { __u64 pid; __u64 raw_rip; // Anti-pattern: Exposing raw execution address (ASLR leak) char arg_buf[128]; // Anti-pattern: Raw string copy without redaction }; SEC("uprobe/sensitive_exec") int BPF_KPROBE(trace_exec, const char *sensitive_arg) { struct profile_sample_t sample = {}; sample.pid = bpf_get_current_pid_tgid() >> 32; struct pt_regs *regs = (struct pt_regs *)ctx; sample.raw_rip = PT_REGS_IP(regs); // CRITICAL FLAW: Reads user argument directly into sample without inspecting // or redacting high-entropy tokens, passwords, or PII before emitting to ring buffer. bpf_probe_read_user_str(&sample.arg_buf, sizeof(sample.arg_buf), sensitive_arg); bpf_ringbuf_output(&sample, sizeof(sample), 0); return 0; } ``` #### Production Standard (Correct) > **Standard**: Pointers are canonicalized to prevent ASLR de-anonymization, string buffers are zero-initialized, read operations are bounds-checked, and in-kernel unrolled sanitization masks sensitive alphanumeric characters prior to ring buffer emission. ```c #include <vmlinux.h> #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> #define MAX_STR_LEN 64 #define REDACTED_MASK 0xDEADBEEF struct profile_sample_t { __u64 pid; __u64 normalized_offset; // Canonicalized frame address char scrubbed_arg[MAX_STR_LEN]; }; static __always_inline void scrub_frame_data(char *dst, const char *src) { long len = bpf_probe_read_user_str(dst, MAX_STR_LEN, src); if (len <= 0) { __builtin_memset(dst, 0, MAX_STR_LEN); return; } // Inline verifier-safe heuristic sanitization: redact potential tokens/PII #pragma unroll for (int i = 0; i < MAX_STR_LEN - 1; i++) { if (i >= len) break; // Redact ASCII digits (e.g., SSN, card patterns) and high-entropy characters if (dst[i] >= '0' && dst[i] <= '9') { dst[i] = 'X'; } } dst[MAX_STR_LEN - 1] = '\0'; } SEC("uprobe/sensitive_exec") int BPF_KPROBE(trace_exec, const char *sensitive_arg) { struct profile_sample_t sample; __builtin_memset(&sample, 0, sizeof(sample)); sample.pid = bpf_get_current_pid_tgid() >> 32; // Mask pointer lower/ASLR bits or map to deterministic synthetic ID __u64 raw_ip = PT_REGS_IP((struct pt_regs *)ctx); sample.normalized_offset = raw_ip & 0xFFFFFFFF00000000ULL ? (raw_ip & 0xFFF) : REDACTED_MASK; scrub_frame_data(sample.scrubbed_arg, sensitive_arg); bpf_ringbuf_output(&sample, sizeof(sample), 0); return 0; } ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: OpenTelemetry eBPF Continuous Profiling In-Kernel PII and Pointer Scrubbing Standard

OpenTelemetry eBPF Continuous Profiling In-Kernel PII and Pointer Scrubbing Standard defines an industrial-grade behavioral standard for devops engineering. Enforces strict in-kernel sanitization and pointer normalization inside eBPF continuous profiling probes prior to user-space ring buffer submission. Prevents inadvertent leakage of Personally Identifiable Information (PII), application secrets, and kernel/user ASLR address layouts to OpenTelemetry collectors. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Exporting Raw Pointer Layouts and Stack String Arguments via Unscrubbed eBPF Profiling Buffers Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Exporting Raw Pointer Layouts and Stack String Arguments via Unscrubbed eBPF Profiling Buffers	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS sanitize raw instruction and stack pointers to base-relative module offsets inside kernel space or user-space symbolication boundaries to avoid leaking ASLR entropy.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.