{"slug": "tetragon-outgoing-guard", "title": "Tetragon Outgoing Guard", "summary": "A new open repository, tetragon-outgoing-guard, publishes declarative eBPF TracingPolicy manifests for Cilium Tetragon that enforce two kernel-level rules on Linux container hosts: an executable allowlist on security_bprm_check that sends a synchronous SIGKILL to any binary outside the approved list (including /bin/sh, /bin/bash, curl, and binaries staged in /dev/shm), and a tcp_connect rule that kills any host_ns process opening a TCP connection to a non-RFC1918 IP. The project targets stealthy post-exploitation implants such as GSocket, which Microsoft has analyzed as relaying C2 traffic over outbound TLS to shared public infrastructure and masquerading binaries via exec -a to mimic kernel threads like [kaluad]. The repository ships standalone-docker.yaml and kubernetes-workload.yaml policies plus a discover-binaries.sh helper, and warns operators to map all legitimate binaries and run in monitor mode before enabling action: Sigkill.", "body_md": "Deterministic, kernel-level runtime security policies for **Cilium Tetragon** designed to block stealthy post-exploitation implants (such as **GSocket**), unauthorized reverse shells, and interactive container escapes (`docker exec ... sh`).\n\nRecent threat intelligence (such as Microsoft's analysis of threat actors weaponizing **GSocket**) highlights how attackers maintain persistent C2 access on Linux container hosts even after initial vulnerabilities are patched:\n\n- **No fixed C2 IP/domain:** Traffic is relayed over public shared infrastructure via outbound TLS connections, bypassing inbound firewall rules.\n- **Process masquerading:** Binaries are staged in memory-backed directories (`/dev/shm` ) and executed with`exec -a` to mimic kernel threads (e.g.,`[kaluad]` ).\n- **Short-lived payloads:** User-space polling scripts inspecting`ps` or`ss` suffer from race conditions against fast`curl | sh` drop-and-execute chains.\n\nInstead of polling in user space or relying on heuristic/AI anomaly detection, this repository provides declarative **eBPF `TracingPolicy` manifests** that enforce two deterministic rules synchronously inside the Linux kernel:\n\n1. **Container Executable Allowlisting (`security_bprm_check`):** Every binary executed inside a non-host PID namespace must match an explicit allowlist of ground-truth binary paths. Anything else—including`/bin/sh` ,`/bin/bash` ,`curl` , or binaries staged in`/dev/shm` —receives an immediate, synchronous kernel`SIGKILL` before execution completes.\n2. **Host Outbound TCP Zero-Trust (`tcp_connect`):** On dedicated container hosts (Docker, Swarm, or Kubernetes nodes) where all application workloads run inside containers, any process in the root`host_ns` initiating a TCP connection to a public (non-RFC1918) IP address is killed immediately.\n\n```\ntetragon-outgoing-guard/\n├── README.md\n├── LICENSE\n├── policies/\n│   ├── standalone-docker.yaml      # TracingPolicy for Docker / Swarm / standalone Linux hosts\n│   └── kubernetes-workload.yaml    # TracingPolicyNamespaced with podSelector for K8s clusters\n├── scripts/\n│   └── discover-binaries.sh        # Helper to extract ground-truth binary paths from running containers\n└── examples/\n    └── docker-compose.tetragon.yml # Deploy Tetragon via Docker Compose or Docker Swarm (global mode)\n```\n\nNever enable `action: Sigkill` before mapping all legitimate binaries used by your containers (including `tini`, entrypoint wrappers, and application runtimes).\n\nRun the discovery helper on your host:\n\n```\nchmod +x scripts/discover-binaries.sh\nsudo ./scripts/discover-binaries.sh\n```\n\nCopy the output paths into `policies/standalone-docker.yaml` under `matchBinaries`.\n\nBefore enforcing `Sigkill`, comment out the `matchActions: - action: Sigkill` blocks in `policies/standalone-docker.yaml` and start Tetragon using the provided Compose file:\n\n```\ndocker compose -f examples/docker-compose.tetragon.yml up -d\n```\n\nWatch live kernel events to verify no legitimate workload triggers the policy:\n\n```\ndocker exec -it tetragon tetra getevents -o compact\n```\n\nUncomment `matchActions: - action: Sigkill` in `policies/standalone-docker.yaml` and restart Tetragon:\n\n```\ndocker compose -f examples/docker-compose.tetragon.yml restart tetragon\n```\n\nVerify enforcement by attempting to spawn a shell inside any running container:\n\n```\ndocker exec -it <your-container> sh\n# Expected output: Killed\n```\n\nTetragon runs alongside any CNI (including **Calico**, Flannel, or Cilium) without conflicts, as it hooks into kernel LSM/kprobe points rather than CNI packet routing.\n\n1. Install Tetragon via Helm:\n\n```\nhelm repo add cilium https://cilium.io\nhelm repo update\nhelm install tetragon cilium/tetragon -n kube-system\n```\n\n2. Edit `policies/kubernetes-workload.yaml` to match your Pod labels and allowed binaries, then apply:\n\n```\nkubectl apply -f policies/kubernetes-workload.yaml\n```\n\nBecause `standalone-docker.yaml` blocks outbound public TCP connections from `host_ns`, package managers on the host (` apt`, `dnf`, `yum`) will be terminated while the policy is active.\n\nUse a shell alias to temporarily unload the policy during host updates:\n\n```\nalias sysupgrade='docker compose -f /path/to/examples/docker-compose.tetragon.yml stop tetragon && sudo apt update && sudo apt upgrade -y; docker compose -f /path/to/examples/docker-compose.tetragon.yml start tetragon'\n```\n\n*(Note: When the Tetragon user-space daemon stops, the kernel automatically closes its BPF file descriptors and unloads the hooks until the container starts again.)*\n\n- **Interpreted languages (Python, Node.js, PHP):**`security_bprm_check` evaluates the binary executable passed to`execve` (e.g.,`/usr/local/bin/python3.12` ), not the`.py` script argument. Allowlisting the interpreter allows any script executed by that interpreter, while still blocking sub-shells (`os.system()` ,`subprocess` calling`/bin/sh` ).\n- **Healthchecks:** If your`Dockerfile` or`docker-compose.yml` defines a`HEALTHCHECK` using`curl` or`wget` , those binaries will be killed unless added to the allowlist. Prefer native TCP/HTTP probes or distroless/Go healthcheck binaries.\n\nCreated by **Daniele Cruciani** ([@danielecr](https://github.com)).\n\nLicensed under the [Apache License 2.0](https://github.com/danielecr/tetragon-outgoing-guard/blob/main/LICENSE).", "url": "https://wpnews.pro/news/tetragon-outgoing-guard", "canonical_source": "https://github.com/danielecr/tetragon-outgoing-guard", "published_at": "2026-11-14 11:29:00+00:00", "updated_at": "2026-11-14 11:49:57.489943+00:00", "lang": "en", "topics": ["ai-safety", "ai-infrastructure", "developer-tools"], "entities": ["Cilium Tetragon", "GSocket", "Microsoft", "Docker", "Kubernetes", "Calico", "Flannel", "Cilium"], "also_reported_by": [], "alternates": {"html": "https://wpnews.pro/news/tetragon-outgoing-guard", "markdown": "https://wpnews.pro/news/tetragon-outgoing-guard.md", "text": "https://wpnews.pro/news/tetragon-outgoing-guard.txt", "jsonld": "https://wpnews.pro/news/tetragon-outgoing-guard.jsonld"}}