adding an event on change_namespace_privilleges_using_unshare #128
Conversation
Signed-off-by: h4l0gen <[email protected]>
| cmd := exec.Command("/bin/sh", "-c", "unshare --fork --pid --mount-proc /bin/bash") | ||
| cmd.SysProcAttr = &syscall.SysProcAttr{ | ||
| Cloneflags: syscall.CLONE_NEWNS | syscall.CLONE_NEWUSER, | ||
| } | ||
|
|
There was a problem hiding this comment.
There was a problem hiding this comment.
Agree, since the condition for the rule is:
evt.type=unshare and evt.dir=<
and container
and not thread.cap_permitted contains CAP_SYS_ADMIN
Signed-off-by: Kapil Sharma <[email protected]>
Co-authored-by: Federico Di Pierro <[email protected]> Signed-off-by: Kapil Sharma <[email protected]>
| "github.com/falcosecurity/event-generator/events" | ||
| ) | ||
|
|
||
| var _ = events.Register(ChangeNamespacePrivilegesViaUnshare) |
There was a problem hiding this comment.
We should disable by default since the rule is an incubating one:
events.WithDisabled(), // this rules is not included in falco_rules.yaml (stable rules), so disable the action
See https://github.com/falcosecurity/rules/blob/main/rules/falco-incubating_rules.yaml#L449
There was a problem hiding this comment.
Now that i double checked, this one too should be disabled by default: https://github.com/falcosecurity/event-generator/pull/153/files
See https://github.com/falcosecurity/rules/blob/main/rules/falco-incubating_rules.yaml#L1263
| "github.com/falcosecurity/event-generator/events" | ||
| ) | ||
|
|
||
| var _ = events.Register(ChangeNamespacePrivilegesViaUnshare) |
There was a problem hiding this comment.
Now that i double checked, this one too should be disabled by default: https://github.com/falcosecurity/event-generator/pull/153/files
See https://github.com/falcosecurity/rules/blob/main/rules/falco-incubating_rules.yaml#L1263
…nge_namespace_privileges_via_unshare.go Signed-off-by: Kapil Sharma <[email protected]>
|
LGTM label has been added. Git tree hash: 7e673f5f43e2486b0eea36b6dc50951d206752c5
|
|
[APPROVALNOTIFIER] This PR is APPROVED This pull-request has been approved by: FedeDP, h4l0gen The full list of commands accepted by this bot can be found here. The pull request process is described here
Needs approval from an approver in each of these files:
Approvers can indicate their approval by writing |
What type of PR is this?
adding an event for stable rule
change_namespace_privillege_using_unshare/kind feature
Any specific area of the project related to this PR?
/area events
What this PR does / why we need it:
Which issue(s) this PR fixes:
Fixes #123
Special notes for your reviewer: