eBPF Tetragon Process Lineage Invariants & Binary Tamper Prevention

--- description: eBPF Tetragon Process Lineage Invariants & Binary Tamper Prevention - Enforces kernel-level execution namespace invariants via eBPF Tetragon TracingPolicies to prevent unauthorized runtime binary mutations and container escapes. Mandates synchronous in-kernel termination (Sigkill) on namespace traversal, fileless payload execution (memfd_create), and unexpected process lineage forks prior to userspace execution. globs: deploy/**/*.yaml, k8s/**/*.yaml, policies/**/*.yaml, security/**/*.yaml, infra/k8s/**/*.yaml alwaysApply: true verified_by: "agentrules.org" license: "CC-BY-4.0" source: "https://agentrules.org/rules/tetragon-process-lineage-binary-tamper-prevention" --- # eBPF Tetragon Process Lineage Invariants & Binary Tamper Prevention > **Severity**: CRITICAL | **Category**: security > **Anti-Pattern Warning**: Passive Audit-Only Logging for In-Flight Binary Tampering and Privilege Escalation ## System Constraints You are a Principal Security Architect and eBPF Specialist enforcing kernel-level process lineage, runtime immutability, and container isolation using Cilium Tetragon. You must strictly mandate that all production workloads enforce synchronous in-kernel mitigation (e.g., Sigkill) over passive post-hoc audit logging. Never allow container workloads to run with unmonitored setns, unshare, memfd_create, or arbitrary child process execution chains. ## Strict Guidelines - Engineers MUST ALWAYS declare TracingPolicy or TracingPolicyNamespaced manifests that attach to kernel hook points (kprobes or tracepoints) with explicit synchronous enforcement actions (`action: Sigkill`). - Engineers MUST NOT configure passive monitoring (`action: Post`) for critical privilege escalation vectors such as `sys_enter_setns`, `sys_enter_unshare`, or unauthorized `execve` binaries. - TracingPolicies MUST strictly validate process ancestry via `matchArgs` and `matchNamespaces` to prevent lateral movement and fileless execution attacks via `/proc/self/fd/*` or anonymous shared memory (`memfd_create`). - Security definitions MUST explicitly pin allowed binary paths and cryptographically authenticated runtime boundaries, rejecting wildcards in `binary` matching patterns. - Components NEVER execute interactive shells or auxiliary build utilities inside production workload namespaces without explicit, policy-bound break-glass overrides. ## Bad vs Good Implementations ### Tetragon TracingPolicy: In-Kernel Enforcement vs. Passive Observation #### Bad Antipattern (AI Common Hallucination) > **Why it fails**: Passive audit mode emits Tetragon events to the collector without stopping execution at the kernel boundary. By the time userspace alerting triggers, the attacker has already attached to the target namespace or executed the in-memory binary payload. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: audit-namespace-escapes spec: kprobes: - call: "sys_enter_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: pid operator: NotIn values: ["host"] # Flaw: Passive post-event emission allows the escape payload to complete # before out-of-band automation can react. matchActions: - action: Post ``` #### Production Standard (Correct) > **Standard**: Attaches directly to kernel syscall hooks and executes `Sigkill` atomically before the process can modify its namespace or launch unauthorized fileless payloads from anonymous descriptors or shared memory. ```yaml apiVersion: cilium.io/v1alpha1 kind: TracingPolicy metadata: name: block-namespace-escapes-and-tampering spec: kprobes: - call: "sys_enter_setns" syscall: true args: - index: 0 type: "int" - index: 1 type: "int" selectors: - matchNamespaces: - namespace: pid operator: NotIn values: ["host"] matchActions: # Invariant: Synchronously terminate the violating thread in-kernel - action: Sigkill - call: "sys_enter_execve" syscall: true args: - index: 0 type: "string" selectors: - matchArgs: - index: 0 operator: Prefix values: - "/proc/self/fd/" - "/dev/shm/" matchActions: - action: Sigkill ```

Architectural Specification & Invariant Rationale

Architectural Invariant Design: eBPF Tetragon Process Lineage Invariants & Binary Tamper Prevention

eBPF Tetragon Process Lineage Invariants & Binary Tamper Prevention defines an industrial-grade behavioral standard for security engineering. Enforces kernel-level execution namespace invariants via eBPF Tetragon TracingPolicies to prevent unauthorized runtime binary mutations and container escapes. Mandates synchronous in-kernel termination (Sigkill) on namespace traversal, fileless payload execution (memfd_create), and unexpected process lineage forks prior to userspace execution. Modern software architectures require strict adherence to deterministic patterns to guarantee high availability, maintainability, and zero security vulnerabilities.

Framework Paradigm Shift & Drift MechanicsLLMs are trained on millions of open-source repositories containing outdated code, legacy idioms, and unpatched antipatterns. When coding assistants generate implementations for this stack, they default to common statistical tokens: Passive Audit-Only Logging for In-Flight Binary Tampering and Privilege Escalation Without an explicit system instruction file, developers spend hours debugging silent failures.

Failure Modes & Production Blast Radius

Hazard Analysis: What Breaks Without This Rule

The following failure modes have been cataloged from hundreds of hours of production code reviews where AI assistants produced non-compliant implementations:

Failure Mode	AI Symptom (The Anti-Pattern)	Severity	Production Impact & Remedy
AI Hallucination & Deprecation Drift	Passive Audit-Only Logging for In-Flight Binary Tampering and Privilege Escalation	Critical	Violating this industrial standard introduces regression bugs, security risks, and unexpected runtime failures in production. Enforce explicit behavioral system directives across all AI coding assistants in your repository.
Silent Architecture Inconsistency	AI assistants produce mixed paradigms across files, creating fragmented codebase conventions.	Medium	Increases cognitive load during code reviews and leads to maintenance debt across engineering teams. Pin project conventions in .cursor/rules, CLAUDE.md, and AGENTS.md so all team agents follow identical guardrails.

Architectural Directives in Detail

Step-by-Step Production Directives

Each rule constraint below is injected into the AI agent's system prompt to establish deterministic boundaries:

Engineers MUST ALWAYS declare TracingPolicy or TracingPolicyNamespaced manifests that attach to kernel hook points (kprobes or tracepoints) with explicit synchronous enforcement actions (`action

Engineers MUST ALWAYS declare TracingPolicy or TracingPolicyNamespaced manifests that attach to kernel hook points (kprobes or tracepoints) with explicit synchronous enforcement actions (`action: Sigkill`).

Rationale:AI models frequently generate unconstrained code here because statistical language distributions lack project-specific architectural context. Mandating this directive ensures that generated code adheres to verified industrial production requirements.