Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

new(rules): introduce rule to detect drop and execute pattern in cont… #20

Merged
merged 3 commits into from
Mar 15, 2023
Merged

new(rules): introduce rule to detect drop and execute pattern in cont… #20

merged 3 commits into from
Mar 15, 2023

Conversation

loresuso
Copy link
Member

…ainers

Signed-off-by: Lorenzo Susini [email protected]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area rules

/area registry

/area build

/area documentation

What this PR does / why we need it:
Moving the discussion here from falcosecurity/falco#2306

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

@poiana
Copy link

poiana commented Jan 25, 2023

@loresuso: The label(s) kind/feature, area/rules cannot be applied, because the repository doesn't have them.

In response to this:

…ainers

Signed-off-by: Lorenzo Susini [email protected]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area rules

/area registry

/area build

/area documentation

What this PR does / why we need it:
Moving the discussion here from falcosecurity/falco#2306

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@poiana poiana requested review from Kaizhe and leodido January 25, 2023 16:26
@poiana poiana added the size/S label Jan 25, 2023
@loresuso loresuso changed the title new(rules): introduce rule to detect drop and execute pattern in cont… wip: new(rules): introduce rule to detect drop and execute pattern in cont… Jan 25, 2023
@loresuso
Copy link
Member Author

loresuso commented Jan 25, 2023 •
edited
Loading

I am putting this on wip because it still needs some more testing.
In the meantime, I have addressed the comments of @incertum (thanks a lot!) that were posted in the old falco PR.
It also would be nice seeing this rule in a new release of the rules so that all falcoctl around the globe can pull it for the first time :)

incertum
incertum reviewed Jan 25, 2023
View reviewed changes
Copy link
Contributor

@incertum incertum left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@loresuso it goes without saying what a game changer this rule is. Knocking out an entire class of vulnerabilities in one simple rule is 🔥 !!! And our journey won't end here 😉 .

Also thanks for adding limitations into the desc, as also bind mounts wouldn't be on the upper layer.

rules/falco_rules.yaml Outdated Show resolved Hide resolved
rules/falco_rules.yaml Outdated Show resolved Hide resolved
rules/falco_rules.yaml Outdated Show resolved Hide resolved
@loresuso loresuso force-pushed the new/rules-exe-upper-layer branch 2 times, most recently from 3d93fa8 to 1f2643a Compare February 3, 2023 09:07
@loresuso loresuso changed the title wip: new(rules): introduce rule to detect drop and execute pattern in cont… new(rules): introduce rule to detect drop and execute pattern in cont… Feb 3, 2023
Kaizhe
Kaizhe reviewed Feb 7, 2023
View reviewed changes
rules/falco_rules.yaml Outdated
Detect if an executable not belonging to the base image of a container is being executed.
The drop and execute pattern can be observed very often after an attacker gained an initial foothold.
is_exe_upper_layer filter field only applies for container runtimes that use overlayfs as union mount filesystem.
condition: spawned_process and container and proc.is_exe_upper_layer=true
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is awesome! @loresuso you should write a blog about this rule.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thank you @Kaizhe, really appreciated! 🙏
Yes, I was thinking about it, I will definitely do it!

Kaizhe
Kaizhe reviewed Feb 7, 2023
View reviewed changes
rules/falco_rules.yaml
The drop and execute pattern can be observed very often after an attacker gained an initial foothold.
is_exe_upper_layer filter field only applies for container runtimes that use overlayfs as union mount filesystem.
condition: spawned_process and container and proc.is_exe_upper_layer=true
output: >
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I think the output is a bit too much.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

What would you drop from here?

Kaizhe
Kaizhe reviewed Feb 7, 2023
View reviewed changes
rules/falco_rules.yaml Outdated Show resolved Hide resolved
@loresuso loresuso force-pushed the new/rules-exe-upper-layer branch from 1f2643a to 4019073 Compare February 9, 2023 10:47
@loresuso loresuso force-pushed the new/rules-exe-upper-layer branch from e9d9627 to e0e74cb Compare February 9, 2023 11:19
@incertum
Copy link
Contributor

incertum commented Feb 9, 2023

@loresuso almost forgot: We need to bump the required_engine_version to I think 15 is the current version, see also #25 to have this as reminder in template.

@loresuso loresuso mentioned this pull request Feb 14, 2023
Closed
FedeDP
FedeDP approved these changes Mar 15, 2023
View reviewed changes
Copy link
Contributor

@FedeDP FedeDP left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Mar 15, 2023
@poiana
Copy link

poiana commented Mar 15, 2023

LGTM label has been added.

Git tree hash: 32c04abde9da8e38f80376bca3bab474e86b7081

@poiana
Copy link

poiana commented Mar 15, 2023

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: FedeDP, loresuso

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@FedeDP
Copy link
Contributor

FedeDP commented Mar 15, 2023

This is an incredibly feat @loresuso ! Nice work!

@poiana poiana merged commit dab4474 into falcosecurity:main Mar 15, 2023
jasondellaluce added a commit that referenced this pull request Jun 12, 2023
@jasondellaluce
fix(rules/falco_rules): solve shadowing issues with `Drop and execute…
630e588 
… new binary in container`

Rule was contributed by Lorenzo Susini in #20.

Co-authored-by: Lorenzo Susini <[email protected]>

Signed-off-by: Jason Dellaluce <[email protected]>
@jasondellaluce jasondellaluce mentioned this pull request Jun 12, 2023
Merged
poiana pushed a commit that referenced this pull request Jun 19, 2023
@jasondellaluce @poiana
fix(rules/falco_rules): solve shadowing issues with `Drop and execute…
f047555 
… new binary in container`

Rule was contributed by Lorenzo Susini in #20.

Co-authored-by: Lorenzo Susini <[email protected]>

Signed-off-by: Jason Dellaluce <[email protected]>
@jasondellaluce jasondellaluce added this to the falco-rules-1.0.0 milestone Jun 20, 2023
jasondellaluce added a commit that referenced this pull request Jun 20, 2023
@jasondellaluce
fix(rules/falco_rules): solve shadowing issues with `Drop and execute…
9f5a03e 
… new binary in container`

Rule was contributed by Lorenzo Susini in #20.

Co-authored-by: Lorenzo Susini <[email protected]>

Signed-off-by: Jason Dellaluce <[email protected]>
poiana pushed a commit that referenced this pull request Jun 21, 2023
@jasondellaluce @poiana
fix(rules/falco_rules): solve shadowing issues with `Drop and execute…
dd42cfd 
… new binary in container`

Rule was contributed by Lorenzo Susini in #20.

Co-authored-by: Lorenzo Susini <[email protected]>

Signed-off-by: Jason Dellaluce <[email protected]>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@incertum incertum incertum left review comments

@Kaizhe Kaizhe Kaizhe left review comments

@FedeDP FedeDP FedeDP approved these changes

@leodido leodido Awaiting requested review from leodido

Assignees

@FedeDP FedeDP

Labels
approved dco-signoff: yes lgtm size/S
Projects
None yet
Milestone
falco-rules-1.0.0
Development

Successfully merging this pull request may close these issues.
6 participants
@loresuso @poiana @incertum @FedeDP @Kaizhe @jasondellaluce