Cilium Tetragon eBPF Kernel-Space Syscall Threat Mitigation and Kill Enforcement

--- description: Cilium Tetragon eBPF Kernel-Space Syscall Threat Mitigation and Kill Enforcement - Mandates strict in-kernel eBPF syscall enforcement and synchronous termination using Cilium Tetragon TracingPolicies. Forbids passive, asynchronous user-space-only audit policies for high-severity container breakouts, privilege escalations, and unauthorized raw socket creation by enforcing immediate Sigkill actions directly inside the Linux kernel. globs: deploy/**/*.yaml, deploy/**/*.yml, k8s/**/*.yaml, k8s/**/*.yml, security/tetragon/**/*.yaml, security/tetragon/**/*.yml, charts/**/tetragon-*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tetragon-ebpf-syscall-enforcement-guardrail" --- # Cilium Tetragon eBPF Kernel-Space Syscall Threat Mitigation and Kill Enforcement > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Deploying Asynchronous Audit-Only eBPF Tracing Policies for High-Risk Kernel Escapes and Raw Socket Creation ## System Constraints You are a Principal Security and DevOps Architect enforcing eBPF Tetragon Kernel Syscall Threat Mitigation. Mandate that containerized workloads enforce synchronous, in-kernel blocking via Tetragon TracingPolicies for dangerous kernel interactions (e.g., setns, unshare, raw sockets, unauthorized binary execution from ephemeral/writable storage). Forbid passive logging for critical exploit vectors; require zero-overhead kernel termination with `Sigkill` actions. ## Strict Guidelines - Engineers MUST ALWAYS configure `TracingPolicy` or `TracingPolicyNamespaced` with `action: Sigkill` for critical exploit vectors such as unauthorized namespace manipulation (`sys_enter_setns`, `sys_enter_unshare`) and raw socket creation (`AF_PACKET`, `AF_INET` with `SOCK_RAW`). - Engineers MUST NOT rely exclusively on passive audit actions (`action: Post`) for syscalls capable of privilege escalation, root namespace escape, or container isolation bypass. - Code SHOULD restrict process execution (`sys_enter_execve`) by filtering against writable directories (`/tmp`, `/dev/shm`, `/var/tmp`) to block dropper and fileless malware execution before user-space processes can react. - Services MUST define granular `matchArgs` and `matchNamespaces` selectors within Tetragon specs to limit probe execution overhead and avoid ring buffer saturation. - Components NEVER grant default cluster-wide catch-all TracingPolicies without explicit workload scoping, ensuring operational reliability and preventing kernel-level denial of service on high-throughput nodes. ## Bad vs Good Implementations ### Tetragon TracingPolicy Enforcement for Namespace Escapes and Raw Socket Creation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Using 'action: Post' merely produces an asynchronous log to Tetragon's userspace daemon. Container escape payloads (like abusing setns to jump into the host PID namespace) or raw socket spoofing execute instantaneously in kernel space, rendering post-execution audit logging useless for active threat mitigation. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-container-escape spec: kprobes: - call: "sys_enter_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" # Flaw: Passive logging only. The exploit finishes executing # before the userspace agent can consume the event from the perf ring buffer. selectors: - matchActions: - action: Post - call: "sys_enter_socket" syscall: true # Flaw: Missing argument filtering and using non-terminating audit selectors: - matchActions: - action: Post ``` #### Production Standard (Correct) > **Standard**: The policy matches specific dangerous arguments (SOCK_RAW) and namespace manipulations (sys_enter_setns) in production namespaces and applies 'action: Sigkill' directly in the eBPF hook program in kernel space, terminating the offending thread before the syscall completes. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: enforce-kernel-escape-and-socket-mitigation spec: kprobes: # Invariant: Block container namespace escaping synchronously - call: "sys_enter_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: production operator: In matchActions: - action: Sigkill # Invariant: Block unauthorized raw socket creation to prevent L2/L3 packet spoofing - call: "sys_enter_socket" syscall: true args: - index: 0 type: "int" # domain (e.g., AF_PACKET = 17) - index: 1 type: "int" # type (e.g., SOCK_RAW = 3) selectors: - matchArgs: - index: 1 operator: "Equal" values: - "3" # SOCK_RAW matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Cilium Tetragon eBPF Kernel-Space Syscall Threat Mitigation and Kill Enforcement

Cilium Tetragon eBPF Kernel-Space Syscall Threat Mitigation and Kill Enforcement defines an industrial-grade behavioral standard for devops engineering. Mandates strict in-kernel eBPF syscall enforcement and synchronous termination using Cilium Tetragon TracingPolicies. Forbids passive, asynchronous user-space-only audit policies for high-severity container breakouts, privilege escalations, and unauthorized raw socket creation by enforcing immediate Sigkill actions directly inside the Linux kernel. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Deploying Asynchronous Audit-Only eBPF Tracing Policies for High-Risk Kernel Escapes and Raw Socket Creation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Deploying Asynchronous Audit-Only eBPF Tracing Policies for High-Risk Kernel Escapes and Raw Socket Creation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure `TracingPolicy` or `TracingPolicyNamespaced` with `action

Engineers MUST ALWAYS configure `TracingPolicy` or `TracingPolicyNamespaced` with `action: Sigkill` for critical exploit vectors such as unauthorized namespace manipulation (`sys_enter_setns`, `sys_enter_unshare`) and raw socket creation (`AF_PACKET`, `AF_INET` with `SOCK_RAW`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.