Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

macro(user_read_sensitive_file_containers): replace endswiths with ex… #1349

Merged
merged 5 commits into from
Aug 13, 2020
Merged

macro(user_read_sensitive_file_containers): replace endswiths with ex… #1349

Changes from all commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
3f8ca67
macro(user_read_sensitive_file_containers): replace endswiths with ex…
Kaizhe Aug 7, 2020
131c6f8
keep both w/ docker.io and w/o docker.io for sysdig images
Kaizhe Aug 8, 2020
c407d71
remove non-oss images in the whitelist
Kaizhe Aug 10, 2020
684ed6e
add sematext images back
Kaizhe Aug 11, 2020
b08563c
minor fix
Kaizhe Aug 13, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
30 changes: 15 additions & 15 deletions rules/falco_rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1458,10 +1458,11 @@
- macro: user_read_sensitive_file_conditions
condition: cmp_cp_by_passwd

- list: read_sensitive_file_images
items: []

- macro: user_read_sensitive_file_containers
condition: (container and
(container.image.repository endswith "sysdig/agent") or
(container.image.repository endswith "sysdig/agent-slim"))
condition: (container and container.image.repository in (read_sensitive_file_images))

- rule: Read sensitive file untrusted
desc: >
Expand Down Expand Up @@ -1830,9 +1831,7 @@
# In this file, it just takes one of the images in trusted_containers
# and repeats it.
- macro: user_trusted_containers
condition: (container.image.repository endswith sysdig/agent or
container.image.repository endswith sysdig/agent-slim or
container.image.repository endswith sysdig/node-image-analyzer)
condition: (never_true)

- list: sematext_images
items: [docker.io/sematext/sematext-agent-docker, docker.io/sematext/agent, docker.io/sematext/logagent,
Expand All @@ -1843,11 +1842,11 @@
# These container images are allowed to run with --privileged
- list: falco_privileged_images
items: [
docker.io/sysdig/agent, docker.io/sysdig/falco, docker.io/sysdig/sysdig,
docker.io/sysdig/falco, docker.io/sysdig/sysdig,
gcr.io/google_containers/kube-proxy, docker.io/calico/node, quay.io/calico/node,
docker.io/rook/toolbox, docker.io/cloudnativelabs/kube-router, docker.io/mesosphere/mesos-slave,
docker.io/docker/ucp-agent, sematext_images, k8s.gcr.io/kube-proxy,
docker.io/falcosecurity/falco
docker.io/falcosecurity/falco, sysdig/falco, sysdig/sysdig, falcosecurity/falco
]

- macro: falco_privileged_containers
Expand All @@ -1856,7 +1855,7 @@
container.image.repository in (trusted_images) or
container.image.repository in (falco_privileged_images) or
container.image.repository startswith istio/proxy_ or
container.image.repository startswith quay.io/sysdig)
container.image.repository startswith quay.io/sysdig/)

# Add conditions to this macro (probably in a separate file,
# overwriting this macro) to specify additional containers that are
Expand All @@ -1865,7 +1864,7 @@
# In this file, it just takes one of the images in falco_privileged_images
# and repeats it.
- macro: user_privileged_containers
condition: (container.image.repository endswith sysdig/agent)
condition: (never_true)

- list: rancher_images
items: [
Expand All @@ -1877,7 +1876,7 @@
# host filesystem.
- list: falco_sensitive_mount_images
items: [
docker.io/sysdig/agent, docker.io/sysdig/falco, docker.io/sysdig/sysdig,
docker.io/sysdig/falco, docker.io/sysdig/sysdig, sysdig/falco, sysdig/sysdig,
gcr.io/google_containers/hyperkube,
gcr.io/google_containers/kube-proxy, docker.io/calico/node,
docker.io/rook/toolbox, docker.io/cloudnativelabs/kube-router, docker.io/consul,
Expand All @@ -1903,7 +1902,7 @@
# In this file, it just takes one of the images in falco_sensitive_mount_images
# and repeats it.
- macro: user_sensitive_mount_containers
condition: (container.image.repository = docker.io/sysdig/agent)
condition: (never_true)

- rule: Launch Privileged Container
desc: Detect the initial process started in a privileged container. Exceptions are made for known trusted images.
Expand Down Expand Up @@ -2362,8 +2361,9 @@
- macro: k8s_containers
condition: >
(container.image.repository in (gcr.io/google_containers/hyperkube-amd64,
gcr.io/google_containers/kube2sky, sysdig/agent, sysdig/falco,
sysdig/sysdig, falcosecurity/falco) or (k8s.ns.name = "kube-system"))
gcr.io/google_containers/kube2sky, docker.io/sysdig/falco,
docker.io/sysdig/sysdig, docker.io/falcosecurity/falco,
sysdig/falco, sysdig/sysdig, falcosecurity/falco) or (k8s.ns.name = "kube-system"))

- macro: k8s_api_server
condition: (fd.sip.name="kubernetes.default.svc.cluster.local")
Expand Down Expand Up @@ -2769,7 +2769,7 @@
condition: (evt.type in (sendto, sendmsg) and evt.dir=< and (fd.net != "127.0.0.0/8" and not fd.snet in (rfc_1918_addresses)) and ((minerpool_http) or (minerpool_https) or (minerpool_other)))

- macro: trusted_images_query_miner_domain_dns
condition: (container.image.repository endswith "sysdig/agent" or container.image.repository endswith "falcosecurity/falco")
condition: (container.image.repository in (docker.io/falcosecurity/falco, falcosecurity/falco))
append: false

# The rule is disabled by default.
Expand Down