A series of feature requirements concerned with namespaces

[MagpieRYL]

Motivation

Intrusion detection in container-based cloud native environment may need observation on namespaces.
In our practise on container escaping detection, we are facing the demands:

• detect namespace breaking through the setns syscall.
• detect namespace breaking through ptrace into a process on host's namespace
• but how could we know the namespace's change when it was breaking 👆 ?

Feature

• parse the raw namespace value of the fd field of the setns syscall
• parse namespace info of the target pid process in ptrace syscall: raw value and type, including (mnt, net, pid, ipc, cgroup, etc.)
• parse the current-event-process's namespace: raw value and type, including (mnt, net, pid, ipc, cgroup, etc.)
• parse the host's root namespace(like systemd's ns): raw value and type, including (mnt, net, pid, ipc, cgroup, etc.)

with these feature above, we can detect the namespace breaking (like utilizing setns/ptrace) by this feature: #2484

[Andreagit97]

Same as #2613, this is an interesting feature and we will try to understand how much effort it will require! Thank you for sharing the knowledge!

[loresuso]

Hello @MagpieRYL, thank you for this issue. I had a similar idea in the past, but I stopped trying to implement it because of the issue you mentioned above (that is, cannot use equality between two fields). Since the security use case is relevant, I really think we can try to understand how to implement this!

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[Andreagit97]

/remove-lifecycle stale

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[poiana]

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

[poiana]

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.