Kernel-Enforced SPIFFE Dynamic Attestation via Linux eBPF LSM Hooks

--- description: Kernel-Enforced SPIFFE Dynamic Attestation via Linux eBPF LSM Hooks - Enforces non-bypassable workload identity verification at the Linux kernel boundary using eBPF LSM hooks prior to socket establishment. Prohibits static secret persistence, environmental tokens, and post-connect user-space authentication by cryptographically binding ephemeral SPIFFE IDs to task credentials and cgroups in kernel memory. globs: bpf/**/*.c, bpf/**/*.h, pkg/attestation/**/*.go, pkg/ebpf/**/*.go, src/security/**/*.rs alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/spiffe-spire-ebpf-lsm-socket-attestation" --- # Kernel-Enforced SPIFFE Dynamic Attestation via Linux eBPF LSM Hooks > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Persisting Static Bootstrap Secrets or Deferring Workload Attestation to User-Space Application Handshakes ## System Constraints You are a Principal Security Architect specializing in Linux kernel security, eBPF LSM, and SPIFFE/SPIRE workload attestation. Mandate that all workload-to-workload communication establishes dynamic identity validation at the kernel layer using eBPF LSM socket hooks prior to TCP SYN transmission. Forbid static filesystem tokens, long-lived API keys, and user-space post-handshake authorization bypasses. Ensure atomic synchronization between the SPIRE Agent workload registry and eBPF kernel maps. ## Strict Guidelines - Engineers MUST ALWAYS hook eBPF LSM programs to 'socket_connect' and 'socket_accept' kernel probes to enforce identity validation before network transit begins. - Engineers MUST NOT persist static bootstrap tokens, long-lived service account secrets, or unencrypted keys to disks, environment variables, or config volumes. - BPF programs MUST query BPF hash or LPM trie maps populated exclusively by an attested SPIRE Agent daemon to verify that task cgroups and PIDs possess a valid SPIFFE ID. - Kernel hooks MUST immediately reject unauthorized connection requests by returning '-EPERM' or '-EACCES' directly from the LSM hook, preventing raw socket ingress/egress. - SPIRE dynamic attestation daemons MUST atomically refresh kernel map entries prior to SVID expiration and synchronously evict dead task credentials via cgroup teardown listeners. - Components NEVER fall back to permissive or unauthenticated transport modes when SPIRE Agent IPC sockets or eBPF maps encounter transient eviction states. ## Bad vs Good Implementations ### eBPF LSM Socket Connect Enforcement vs. Vulnerable User-Space Secret Attestation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The connection is established prior to workload identity validation, creating an attack vector for unauthenticated socket hijacking. Relying on static filesystem secrets exposes tokens to unauthorized reads, symlink attacks, and lateral privilege escalation. ```c // VULNERABLE: Application connects without kernel verification, relying on a mounted disk token #include <sys/socket.h> #include <stdio.h> #include <unistd.h> int establish_connection(struct sockaddr *serv_addr, socklen_t addrlen) { int sock = socket(AF_INET, SOCK_STREAM, 0); // Network connection is established before any cryptographic workload identity check if (connect(sock, serv_addr, addrlen) < 0) { return -1; } // Anti-pattern: Reading static secret from disk to authenticate in user space FILE *f = fopen("/var/run/secrets/token.jwt", "r"); if (!f) { close(sock); return -EACCES; } // Token exposure to memory dumping, disk exfiltration, and socket hijacking fclose(f); return sock; } ``` #### Production Standard (Correct) > **Standard**: Workload authenticity is dynamically verified at the kernel layer using Linux eBPF LSM before any network packet leaves the host. Static secrets on disk are completely eliminated, and unauthenticated or expired processes receive an immediate -EPERM. ```c // SECURE: Kernel-enforced dynamic workload identity check via eBPF LSM hook #include "vmlinux.h" #include <bpf/bpf_helpers.h> #include <bpf/bpf_tracing.h> #include <bpf/bpf_core_read.h> #define EPERM 1 struct identity_val { __u32 spiffe_id_hash; __u64 expires_at; }; struct { __uint(type, BPF_MAP_TYPE_HASH); __uint(max_entries, 65536); __type(key, __u64); // cgroup_id __type(value, struct identity_val); } spire_identity_map SEC(".maps"); SEC("lsm/socket_connect") int BPF_PROG(enforce_spiffe_socket_connect, struct socket *sock, struct sockaddr *address, int addrlen) { __u64 cgroup_id = bpf_get_current_cgroup_id(); struct identity_val *id = bpf_map_lookup_elem(&spire_identity_map, &cgroup_id); // Block socket creation if workload is not attested by SPIRE agent in kernel map if (!id) { return -EPERM; } // Verify dynamic SVID validity window directly inside kernel memory __u64 now = bpf_ktime_get_ns(); if (now > id->expires_at) { return -EPERM; } return 0; } char _license[] SEC("license") = "GPL"; ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Kernel-Enforced SPIFFE Dynamic Attestation via Linux eBPF LSM Hooks

Kernel-Enforced SPIFFE Dynamic Attestation via Linux eBPF LSM Hooks defines an industrial-grade behavioral standard for security engineering. Enforces non-bypassable workload identity verification at the Linux kernel boundary using eBPF LSM hooks prior to socket establishment. Prohibits static secret persistence, environmental tokens, and post-connect user-space authentication by cryptographically binding ephemeral SPIFFE IDs to task credentials and cgroups in kernel memory. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Persisting Static Bootstrap Secrets or Deferring Workload Attestation to User-Space Application Handshakes Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Persisting Static Bootstrap Secrets or Deferring Workload Attestation to User-Space Application Handshakes	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS hook eBPF LSM programs to 'socket_connect' and 'socket_accept' kernel probes to enforce identity validation before network transit begins.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.