enable "Packet socket created in container" by default.

[rung]

Signed-off-by: Hiroki Suezawa [email protected]

What type of PR is this?
/kind rule-update

Any specific area of the project related to this PR?
/area rules

What this PR does / why we need it:

• I want to enable "Packet socket created in container" rule by default.

• "Packet socket created in container" rule was created at the end of last year. I think we can say the rule is stable.

  • rule update: Add rules to detect raw packets creation #945

• The rule can detect ARP spoofing attacks on Kubernetes.

  • Ref: https://blog.aquasec.com/dns-spoofing-kubernetes-clusters

• and new kernel vulnerability(CVE-2020-14386, allow privilege escalation to node) was disclosed recently.

  • The bug is in net/packet/af_packet.c, so we could detect an attack to the vuln by this rule as far as I read reporter's message and patch.
    • fyi: the rule can detect socket(AF_PACKET, ... syscall.
  • This is High severity bug, It's great if Falco can detect it by default!
  • Ref: https://cloud.google.com/kubernetes-engine/docs/security-bulletins?hl=en#gcp-2020-012

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

rule(macro consider_packet_socket_communication): enable "Packet socket created in container" rule by default.

[poiana]

LGTM label has been added.

Git tree hash: 7e7268728ce7e5eef378b85cada3e3109cad2f76

[fntlnz]

Thanks @rung !

@Kaizhe PTAL :)

[leodido]

💯

[Kaizhe]

I am on paternity leave now so I will defer to @mstemm , for not blocking the PR review.

[leogr]

I'm closing and re-opening this to let GitHub checks start again

[fntlnz]

This seems to be stuck. I'll look at the web hooks. Thanks for the patience @rung

[rung]

Thanks! no problem.
if I can do something to resolve the issue, feel free to ask me 👍

[fntlnz]

The webhook was fine, looks like circleci is not keeping it.

[rung]

let me rebase master, and force push to re-run CI 👍

[rung]

🎉 It seems I had to refresh CircleCI settings on my side. The CI passed finally 😄

@fntlnz @leodido @leogr
Thank you for checking the CI status. Could you review this PR again when you have a time?

[leogr]

LGTM

[poiana]

LGTM label has been added.

Git tree hash: 6d1bb0195b7edda951fd767232dc55e4a528a081

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fntlnz, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [fntlnz,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment