Linux kernel / bpf / verifier / program load
The eBPF Verifier Rejects Correct Programs
That eBPF means running your own code in the kernel, so a program that compiles and is correct will load. It will not. The verifier walks every reachable path and must prove termination, memory safety and helper eligibility on all of them within a fixed budget: 1,000,000 instruction steps, 512 bytes of stack, 8,192 nested branch states. Correct, non-malicious code is rejected constantly — a loop that obviously terminates to a human is rejected because the trip count is not visible to the verifier; a pointer that is never null in practice is rejected because nothing on the path proves it; a body of trivially fine branches is rejected because their product exceeds the budget. Engineers read the rejection as a bug report and go hunting for a logic error that is not there. The fix is almost always to make an existing fact provable, not to change what the program does.
Every eBPF program is symbolically executed at load time by a kernel proof engine that must show safety on every path it can reach, so a program is accepted when the proof succeeds and rejected when the proof runs out of budget — which is a different question from whether the program is correct.
The lesson that sent you here
- Kernel Enforcement Cannot See Intent
That putting Tetragon or Falco under an agent contains it, because eBPF sees everything and blocks in-kernel at microsecond latency. Coverage really is that good and the block really does hold. The gap is semantic: the hook sees an outbound connection to an allowed address, not that a prompt injection caused it or that the bytes are rows from a table the agent was never meant to query. Because a legitimate agent's paths, hosts and processes drift prompt to prompt, a learned allowlist is either loose enough to contain the attacker's primitives too or tight enough to break the agent — and the settings in between shrink to nothing as that drift grows. The designs that work concede this by construction: they use eBPF to see and to redirect, and put the decision at a layer that has the nouns — an L7 proxy, a per-agent identity, a network policy, an admission rule. The cost of not knowing that is a control that is trusted, correct, and produces no security.
1 published lesson depends on this concept, which is what moves it up the writing queue. Nothing is hidden behind this page — it has not been written.