Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

kh: exclude rancher events #559

Merged
merged 2 commits into from
Mar 15, 2019
Merged

kh: exclude rancher events #559

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
8465ff3
kh: exclude rancher events
Kaizhe Mar 8, 2019
e80d286
v2
Kaizhe Mar 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
18 changes: 18 additions & 0 deletions rules/falco_rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -619,6 +619,9 @@
- macro: liveupdate_writing_conf
condition: (proc.cmdline startswith "java LiveUpdate" and fd.name in (/etc/liveupdate.conf, /etc/Product.Catalog.JavaLiveUpdate))

- macro: rancher_agent
condition: (proc.name = agent and container.image.repository = rancher/agent)

- macro: sosreport_writing_files
condition: >
(proc.name=urlgrabber-ext- and proc.aname[3]=sosreport and
Expand Down Expand Up @@ -817,6 +820,13 @@
proc.cmdline startswith "agent.py /opt/datadog-agent")
and fd.name startswith "/etc/dd-agent")

- macro: rancher_writing_conf
condition: (container.image.repository in (rancher_images)
and proc.name in (lib-controller,rancher-dns,healthcheck,rancher-metadat)
and (fd.name startswith "/etc/haproxy" or
fd.name startswith "/etc/rancher-dns")
)

- macro: curl_writing_pki_db
condition: (proc.name=curl and fd.directory=/etc/pki/nssdb)

Expand Down Expand Up @@ -985,6 +995,7 @@
and not calico_writing_conf
and not prometheus_conf_writing_conf
and not openshift_writing_conf
and not rancher_writing_conf

- rule: Write below etc
desc: an attempt to write to any file below /etc
Expand Down Expand Up @@ -1219,6 +1230,7 @@
and not python_running_sdchecks
and not java_running_sdjagent
and not kubelet_running_loopback
and not rancher_agent
output: >
Namespace change (setns) by unexpected program (user=%user.name command=%proc.cmdline
parent=%proc.pname %container.info)
Expand Down Expand Up @@ -1411,6 +1423,12 @@
container.image.repository startswith istio/proxy_ or
container.image.repository startswith quay.io/sysdig)

- list: rancher_images
items: [
rancher/network-manager, rancher/dns, rancher/agent,
rancher/lb-service-haproxy, rancher/metadata, rancher/healthcheck
]

# Add conditions to this macro (probably in a separate file,
# overwriting this macro) to specify additional containers that are
# trusted and therefore allowed to run privileged.
Expand Down