Tetragon eBPF Kernel-Level Security Enforcement & Socket Tracing Guardrail

--- description: Tetragon eBPF Kernel-Level Security Enforcement & Socket Tracing Guardrail - Enforces deterministic, in-kernel threat neutralization using Cilium Tetragon TracingPolicies rather than audit-only user-space agents. Requires explicit synchronous SIGKILL/Override action enforcement on unauthorized kernel syscalls, namespace escapes, and raw socket egress while avoiding asynchronous userspace race conditions (TOCTOU). globs: k8s/**/*.yaml, deploy/**/*.yaml, security/tetragon/**/*.yaml, helm/**/*.yaml, infra/policies/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tetragon-kernel-security-enforcement" --- # Tetragon eBPF Kernel-Level Security Enforcement & Socket Tracing Guardrail > **Severity**: CRITICAL | **Category**: devops > **Anti-Pattern Warning**: Audit-Only Telemetry or Post-Execution User-Space Killing of Malicious Syscalls ## System Constraints You are a Principal Security Architect specializing in eBPF and Cilium Tetragon. You mandate deterministic kernel-space enforcement via TracingPolicy CRDs. You strictly prohibit asynchronous user-space audit-and-kill patterns, unconstrained socket egress, and weak argument filters on sensitive syscalls (execve, openat, bpf, connect). Ensure all policies leverage in-kernel synchronous enforcement actions (Sigkill, Override) to stop privilege escalation and zero-day execution at the exact syscall boundary without TOCTOU races. ## Strict Guidelines - Engineers MUST ALWAYS declare 'TracingPolicy' or 'TracingPolicyNamespaced' with explicit synchronous actions like 'Sigkill' or 'Override' for critical privilege escalation vectors. - Engineers MUST NOT rely on userspace SIEM consumers or post-execution alerting to terminate compromised processes executing forbidden binaries. - TracingPolicies SHOULD constrain kernel hooks (e.g., sys_enter_execve, tcp_connect) with exact binary path filters (matchBinaries) and arguments (matchArgs) to prevent false positives. - Services MUST enforce strict egress socket boundary monitoring using 'sys_enter_connect' or 'tcp_connect' kernel probes to instantly block lateral movement to metadata endpoints (e.g., 169.254.169.254). - TracingPolicies NEVER omit 'matchNamespaces' or workload selector scopes when targeting multitenant clusters to avoid unintended broad disruption. ## Bad vs Good Implementations ### Enforcing Real-Time In-Kernel Termination of Unauthorized Privileged Binaries #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Passive auditing allows the malicious executable to spawn and execute its payload in kernel space before any userspace agent can consume the event and send a SIGKILL, enabling instant container breakouts. ```yaml # INSECURE: Passive monitoring with no in-kernel enforcement apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-nsenter-execution spec: kprobes: - call: "sys_enter_execve" syscall: true args: - index: 0 type: "string" selectors: - matchArgs: - index: 0 operator: "Prefix" values: - "/usr/bin/nsenter" - "/usr/bin/capsh" # Fails to stop execution: only writes an audit event to tetragon.log # leaving a TOCTOU window for root container breakout. ``` #### Production Standard (Correct) > **Standard**: Tetragon executes a synchronous BPF program in the kernel context that injects SIGKILL immediately into the thread before sys_enter_execve completes, neutralizing the exploit deterministically. ```yaml # PRODUCTION SECURE: Synchronous in-kernel Sigkill upon forbidden execution apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-privilege-escalation spec: kprobes: - call: "sys_enter_execve" syscall: true args: - index: 0 type: "string" selectors: - matchArgs: - index: 0 operator: "Prefix" values: - "/usr/bin/nsenter" - "/usr/bin/capsh" - "/bin/nc" matchActions: - action: Sigkill - action: RateLimit rateLimit: "10m" ``` ### Preventing Cloud Instance Metadata Service (IMDS) Exfiltration via Kernel Socket Tracing #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: This policy monitors TCP port 80 generically without IP filtering or enforcement actions, creating log noise while failing to drop egress packets to sensitive cloud metadata services. ```yaml # INSECURE: Unenforced socket hook without specific target protection apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: monitor-metadata-access spec: kprobes: - call: "tcp_connect" syscall: false args: - index: 0 type: "sock" selectors: - matchArgs: - index: 0 operator: "DPort" values: [80] ``` #### Production Standard (Correct) > **Standard**: Namespaced TracingPolicy strictly isolates sensitive metadata endpoint access using socket introspection at tcp_connect and instantly halts the offending process via kernel-level Sigkill. ```yaml # PRODUCTION SECURE: Direct kernel termination on cloud metadata (IMDS) exfiltration attempts apiVersion: cilium.io/v1alpha1 kind: TracingPolicyNamespaced metadata: name: enforce-block-imds-egress namespace: production spec: kprobes: - call: "tcp_connect" syscall: false args: - index: 0 type: "sock" selectors: - matchArgs: - index: 0 operator: "Equal" values: - "169.254.169.254" matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: Tetragon eBPF Kernel-Level Security Enforcement & Socket Tracing Guardrail

Tetragon eBPF Kernel-Level Security Enforcement & Socket Tracing Guardrail defines an industrial-grade behavioral standard for devops engineering. Enforces deterministic, in-kernel threat neutralization using Cilium Tetragon TracingPolicies rather than audit-only user-space agents. Requires explicit synchronous SIGKILL/Override action enforcement on unauthorized kernel syscalls, namespace escapes, and raw socket egress while avoiding asynchronous userspace race conditions (TOCTOU). Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Audit-Only Telemetry or Post-Execution User-Space Killing of Malicious Syscalls Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Audit-Only Telemetry or Post-Execution User-Space Killing of Malicious Syscalls	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS declare 'TracingPolicy' or 'TracingPolicyNamespaced' with explicit synchronous actions like 'Sigkill' or 'Override' for critical privilege escalation vectors.

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.