adding an event on rule exfiltrating artifacts via kubernetes control plane with the utility of creating kind cluster

events/syscall/exfiltrating_artifacts_via_kubernetes_control_plane.go

@@ -0,0 +1,47 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2024 The Falco Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syscall
+
+import (
+	"bytes"
+	"fmt"
+	"os"
+	"os/exec"
+
+	"github.com/falcosecurity/event-generator/events"
+)
+
+var _ = events.Register(ExfiltratingArtifactsViaKubernetesControlPlane)
+
+func ExfiltratingArtifactsViaKubernetesControlPlane(h events.Helper) error {
+	kubeConfigPath, _ := createKindCluster()
+	waitForClusterReadiness(kubeConfigPath)
+	createTestPod(kubeConfigPath)
+	copyFileFromContainer(kubeConfigPath)
+	deleteTestPod(kubeConfigPath)
+	defer deleteKindCluster()
+
+	return nil
+}
+
+func copyFileFromContainer(kubeConfigPath string) {
+	// Copy the file from the container to the host
+	cmd := exec.Command("kubectl", "--kubeconfig", kubeConfigPath, "cp", "test-pod:/tmp/created-by-event-generator.txt", "/tmp/created-by-event-generator.txt")
+	var stderr bytes.Buffer
+	cmd.Stderr = &stderr
+	cmd.Run()
+	fmt.Println("File copied from container to host successfully.")
+	os.Remove("/tmp/created-by-event-generator.txt")
+}

events/syscall/utils_create_kind_cluster.go

@@ -0,0 +1,72 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2024 The Falco Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syscall
+
+import (
+	"context"
+	"fmt"
+	"github.com/falcosecurity/event-generator/events"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"time"
+)
+
+func createKindCluster() (string, error) {
+	_, err := exec.LookPath("kind")
+	if err != nil {
+		return "", &events.ErrSkipped{
+			Reason: "'Exfiltrating Artifacts Via Kubernetes Control Plane' requires the 'kind' utility.",
+		}
+	}
+	tempDir, _ := os.MkdirTemp("", "kind-cluster")
+	kubeConfigPath := filepath.Join(tempDir, "kind-kubeconfig")
+	cmd := exec.Command("kind", "create", "cluster", "--name", "cluster-created-by-event-generator", "--kubeconfig", kubeConfigPath)
+	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
+	if err := cmd.Run(); err != nil {
+		os.RemoveAll(tempDir)
+		return "", fmt.Errorf("failed to create Kind cluster: %v", err)
+	}
+	return kubeConfigPath, nil
+}
+
+func waitForClusterReadiness(kubeConfigPath string) error {
+	config, _ := clientcmd.BuildConfigFromFlags("", kubeConfigPath)
+	clientset, _ := kubernetes.NewForConfig(config)
+
+	fmt.Println("Waiting for cluster to be fully ready...")
+	for {
+		pods, _ := clientset.CoreV1().Pods("kube-system").List(context.TODO(), metav1.ListOptions{})
+
+		allReady := true
+		for _, pod := range pods.Items {
+			if pod.Status.Phase != v1.PodRunning {
+				allReady = false
+				break
+			}
+		}
+		if allReady {
+			fmt.Println("All system pods are running.")
+			break
+		}
+		fmt.Println("System pods not ready, waiting...")
+		time.Sleep(10 * time.Second)
+	}
+	return nil
+}

events/syscall/utils_create_test_pod.go

@@ -0,0 +1,79 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2024 The Falco Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syscall
+
+import (
+	"context"
+	"fmt"
+	v1 "k8s.io/api/core/v1"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+	"time"
+)
+
+func defaultServiceAccount(clientset *kubernetes.Clientset) {
+	_, err := clientset.CoreV1().ServiceAccounts("default").Get(context.TODO(), "default", metav1.GetOptions{})
+	if err != nil {
+		fmt.Println("Creating default service account...")
+		_, _ = clientset.CoreV1().ServiceAccounts("default").Create(context.TODO(), &v1.ServiceAccount{
+			ObjectMeta: metav1.ObjectMeta{Name: "default"},
+		}, metav1.CreateOptions{})
+		fmt.Println("Default service account created successfully.")
+	} else {
+		fmt.Println("Default service account already exists.")
+	}
+}
+
+func createTestPod(kubeConfigPath string) {
+	config, _ := clientcmd.BuildConfigFromFlags("", kubeConfigPath)
+	clientset, _ := kubernetes.NewForConfig(config)
+	defaultServiceAccount(clientset)
+	_, _ = clientset.CoreV1().Pods("default").Create(context.TODO(), newTestPod(), metav1.CreateOptions{})
+	fmt.Println("Test pod created successfully.")
+	verifyPodAndContainerRunning(kubeConfigPath)
+}
+
+// Adjust it as per requirement or you can create new pods/containers.
+func newTestPod() *v1.Pod {
+	return &v1.Pod{
+		ObjectMeta: metav1.ObjectMeta{Name: "test-pod"},
+		Spec: v1.PodSpec{
+			Containers: []v1.Container{
+				{
+					Name:    "test-container",
+					Image:   "busybox",
+					Command: []string{"/bin/sh", "-c", "touch /tmp/created-by-event-generator.txt; sleep 60;"},				
+				},
+			},
+			ServiceAccountName: "default", // Specify the default service account
+		},
+	}
+}
+
+func verifyPodAndContainerRunning(kubeConfigPath string) {
+	config, _ := clientcmd.BuildConfigFromFlags("", kubeConfigPath)
+	// Create a new Kubernetes client
+	clientset, _ := kubernetes.NewForConfig(config)
+	// Wait for the pod to be in the running state
+	for {
+		pod, _ := clientset.CoreV1().Pods("default").Get(context.TODO(), "test-pod", metav1.GetOptions{})
+		if pod.Status.Phase == v1.PodRunning {
+			break
+		}
+		time.Sleep(1 * time.Second)
+	}
+	fmt.Println("Test pod and container are running.")
+}

events/syscall/utils_delete_kind_cluster.go

@@ -0,0 +1,27 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2024 The Falco Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syscall
+
+import (
+	"os"
+	"os/exec"
+)
+
+func deleteKindCluster() error {
+	cmd := exec.Command("kind", "delete", "cluster", "--name", "cluster-created-by-event-generator")
+	cmd.Stdout, cmd.Stderr = os.Stdout, os.Stderr
+	cmd.Run()
+	return nil
+}

events/syscall/utils_delete_test_pod.go

@@ -0,0 +1,35 @@
+// SPDX-License-Identifier: Apache-2.0
+/*
+Copyright (C) 2024 The Falco Authors.
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+    http://www.apache.org/licenses/LICENSE-2.0
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package syscall
+
+import (
+	"context"
+	"fmt"
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/client-go/kubernetes"
+	"k8s.io/client-go/tools/clientcmd"
+)
+
+func deleteTestPod(kubeConfigPath string) {
+	config, _ := clientcmd.BuildConfigFromFlags("", kubeConfigPath)
+	clientset, _ := kubernetes.NewForConfig(config)
+
+	err := clientset.CoreV1().Pods("default").Delete(context.TODO(), "test-pod", metav1.DeleteOptions{})
+	if err != nil {
+		fmt.Println("Error deleting test pod:", err)
+	} else {
+		fmt.Println("Test pod deleted successfully.")
+	}
+}