Synchronous eBPF Tetragon Kernel-Level Process Ancestry and Namespace Escape Guardrails

Enforces synchronous in-kernel enforcement using Cilium Tetragon TracingPolicies to terminate unauthorized process execution, namespace transitions, and capability escalation before system calls return to user space. Prevents asynchronous post-exploitation telemetry delays by utilizing eBPF kprobe/tracepoint overrides and SIGKILL actions on ancestry policy violations. Mandates strict container namespace immutability and parent-child execution path constraints across containerized deployments.

--- description: Synchronous eBPF Tetragon Kernel-Level Process Ancestry and Namespace Escape Guardrails - Enforces synchronous in-kernel enforcement using Cilium Tetragon TracingPolicies to terminate unauthorized process execution, namespace transitions, and capability escalation before system calls return to user space. Prevents asynchronous post-exploitation telemetry delays by utilizing eBPF kprobe/tracepoint overrides and SIGKILL actions on ancestry policy violations. Mandates strict container namespace immutability and parent-child execution path constraints across containerized deployments. globs: deploy/tetragon/**/*.yaml, k8s/security/**/*.yaml, infra/policies/**/*.yaml, charts/**/templates/tracingpolicy*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tetragon-kernel-exec-ancestry-enforcement" --- # Synchronous eBPF Tetragon Kernel-Level Process Ancestry and Namespace Escape Guardrails > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Relying on asynchronous user-space audit daemons or passive eBPF event streams that detect privilege escalation and container escapes only after syscall completion. ## System Constraints You are a Principal Security and Systems Architect specializing in eBPF kernel enforcement and Tetragon runtime security. Mandate synchronous in-kernel blocking of unauthorized namespace transitions (setns, unshare), privilege escalations (commit_creds, cap_capable), and unexpected binary execution ancestry. Reject passive monitoring patterns where malicious payloads can execute syscalls before alert processing. ## Strict Guidelines - Engineers MUST ALWAYS configure Tetragon TracingPolicy resources with synchronous kernel-level actions such as 'Sigkill' or 'Override' for critical privilege escalation vectors rather than passive 'Post' audit logging. - Engineers MUST NOT allow workloads to execute binaries outside of declared binary ancestry paths or invoke namespace manipulation syscalls (e.g., sys_setns, sys_unshare) within unprivileged container scopes. - TracingPolicies MUST filter explicitly on pod namespaces or container labels to prevent broad unintended kernel overrides on critical host-level node daemons. - Policies SHOULD match against binary path prefixes and process binary arguments using 'matchArgs' and 'matchBinaries' selectors to prevent binary replacement attacks and living-off-the-land techniques. - Policies MUST validate kernel hook points (e.g., __x64_sys_execve, __x64_sys_setns, commit_creds) against target kernel architecture support before deploying override-capable policies. ## Bad vs Good Implementations ### Passive eBPF Audit Logging vs Synchronous In-Kernel Sigkill Enforcement #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Passive TracingPolicy without in-kernel actions creates a race condition where the process successfully switches namespaces and executes malicious instructions before user-space detection engines can respond. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: detect-namespace-escape spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" # Flaw: No synchronous action configured. Emits an event to user-space # Tetragon daemon after the syscall has already transitioned namespaces, # allowing the exploit payload to run uninhibited. ``` #### Production Standard (Correct) > **Standard**: Synchronously attaches an eBPF program that sends SIGKILL to the offending process before sys_setns can complete, neutralizing the namespace escape attempt within kernel space. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-namespace-escape spec: kprobes: - call: "sys_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: production operator: In matchActions: - action: Sigkill podSelector: matchLabels: app.kubernetes.io/part-of: payment-service ``` ### Unrestricted Execution vs Strict Binary Ancestry and In-Kernel Execution Kill #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: The policy merely observes binary executions without asserting expected parent process ancestry or aborting illegal shells spawned from web servers. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: monitor-exec spec: kprobes: - call: "__x64_sys_execve" syscall: true args: - index: 0 type: "string" # Flaw: Unconstrained process execution monitoring without binary ancestry restrictions # or synchronous enforcement allows interactive reverse shells to execute. ``` #### Production Standard (Correct) > **Standard**: Restricts execution by evaluating the parent binary in kernel memory; if a web server attempts to spawn an interactive shell, Tetragon synchronously kills the child process via eBPF before execution proceeds. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: enforce-binary-ancestry spec: kprobes: - call: "__x64_sys_execve" syscall: true args: - index: 0 type: "string" selectors: - matchBinaries: - operator: "In" values: - "/bin/sh" - "/bin/bash" - "/usr/bin/dash" matchParentBinaries: - operator: "In" values: - "/usr/local/bin/node" - "/usr/sbin/nginx" matchActions: - action: Sigkill podSelector: matchLabels: tier: frontend ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Synchronous eBPF Tetragon Kernel-Level Process Ancestry and Namespace Escape Guardrails

Synchronous eBPF Tetragon Kernel-Level Process Ancestry and Namespace Escape Guardrails defines an industrial-grade behavioral standard for devops engineering. Enforces synchronous in-kernel enforcement using Cilium Tetragon TracingPolicies to terminate unauthorized process execution, namespace transitions, and capability escalation before system calls return to user space. Prevents asynchronous post-exploitation telemetry delays by utilizing eBPF kprobe/tracepoint overrides and SIGKILL actions on ancestry policy violations. Mandates strict container namespace immutability and parent-child execution path constraints across containerized deployments. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Relying on asynchronous user-space audit daemons or passive eBPF event streams that detect privilege escalation and container escapes only after syscall completion. Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Relying on asynchronous user-space audit daemons or passive eBPF event streams that detect privilege escalation and container escapes only after syscall completion.	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS configure Tetragon TracingPolicy resources with synchronous kernel-level actions such as 'Sigkill' or 'Override' for critical privilege escalation vectors rather than passive 'Post' audit logging.

Engineers MUST ALWAYS configure Tetragon TracingPolicy resources with synchronous kernel-level actions such as 'Sigkill' or 'Override' for critical privilege escalation vectors rather than passive 'Post' audit logging.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.