Встроенные правила аудита

spawned_process and container and user.name != "_apt" and package_mgmt_procs and not package_mgmt_ancestor_procs

Package management process launched in container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag exe_flags=%evt.arg.flags)

apt -h

spawned_process and container and proc.is_exe_upper_layer=true and not container.image.repository in (known_drop_and_execute_containers)

Executing binary not part of base image (user=%user.name user_loginuid=%user.loginuid user_uid=%user.uid comm=%proc.cmdline exe=%proc.exe container_id=%container.id image=%container.image.repository proc.name=%proc.name proc.sname=%proc.sname proc.pname=%proc.pname proc.aname[2]=%proc.aname[2] exe_flags=%evt.arg.flags proc.exe_ino=%proc.exe_ino proc.exe_ino.ctime=%proc.exe_ino.ctime proc.exe_ino.mtime=%proc.exe_ino.mtime proc.exe_ino.ctime_duration_proc_start=%proc.exe_ino.ctime_duration_proc_start proc.exepath=%proc.exepath proc.cwd=%proc.cwd proc.tty=%proc.tty container.start_ts=%container.start_ts proc.sid=%proc.sid proc.vpgid=%proc.vpgid evt.res=%evt.res)

cp /bin/echo /tmp/falco-drop-exec
/tmp/falco-drop-exec Hello, Falco!

chmod and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not kubelet_pod_volume and not image_scanner_drift and not deckhouse_controller_drift and not neuvector_container and not vault_env_injector_drift and not nginx_ingress_drift and evt.rawres>=0 and (
  (evt.arg.mode contains "S_IXUSR")
  or (evt.arg.mode contains "S_IXGRP")
  or (evt.arg.mode contains "S_IXOTH")
)

Drift detected (chmod), new executable created in a container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode event=%evt.type container_id=%container.id image=%container.image.repository)

echo "echo Hello, Falco!" > /tmp/falco-chmod.sh
chmod +x /tmp/falco-chmod.sh
/tmp/falco-chmod.sh

evt.type in (open,openat,openat2,creat) and evt.is_open_exec=true and container and not runc_writing_exec_fifo and not runc_writing_var_lib_docker and not runc_writing_var_lib_containerd and not kubelet_pod_volume and not image_scanner_drift and not deckhouse_controller_drift and not neuvector_container and not vault_env_injector_drift and not nginx_ingress_drift and not lvm_lock_drift and evt.rawres>=0

Drift detected (open+create), new executable created in a container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid filename=%evt.arg.filename name=%evt.arg.name mode=%evt.arg.mode event=%evt.type container_id=%container.id image=%container.image.repository)

# The file is created anew: an open of an existing file creates no executable.
rm -f /tmp/falco-drift-exec
cat << 'EOF' > /tmp/falco-drift.c
#define _GNU_SOURCE
#include <stdio.h>
#include <unistd.h>
#include <fcntl.h>
#include <string.h>
#include <sys/stat.h>
int main() {
    char path[] = "/tmp/falco-drift-exec";
    char *text = "#!/bin/sh\necho HACKED\n";
    int fd = open(path, O_RDWR | O_CREAT | O_TRUNC, 0755);
    write(fd, text, strlen(text));
    fchmod(fd, 0755);
    char *const args[] = {path, NULL};
    execv(path, args);
}
EOF
gcc /tmp/falco-drift.c -o /tmp/falco-drift
/tmp/falco-drift

container and bin_dir_rename and modify and not package_mgmt_procs and evt.rawres>=0

File below known binary directory renamed/removed (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid pcmdline=%proc.pcmdline operation=%evt.type file=%fd.name %evt.args container_id=%container.id image=%container.image.repository)

touch /usr/bin/falco-evil
mv /usr/bin/falco-evil /usr/bin/falco-eviltwin
rm -f /usr/bin/falco-eviltwin

(kevt and kcreate and pod and response_successful)

K8s Pod Created (user=%ka.user.name pod=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete pod falco-pod-created --ignore-not-found --grace-period=0 >/dev/null 2>&1 || true' EXIT
kubectl run falco-pod-created --image=mirror.gcr.io/library/alpine:3.22 -- /bin/sh -c "while true; do sleep 3600; done"
kubectl delete pod falco-pod-created --grace-period=0

(kevt and kdelete and pod and response_successful)

K8s Pod Deleted (user=%ka.user.name pod=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete pod falco-pod-deleted --ignore-not-found --grace-period=0 >/dev/null 2>&1 || true' EXIT
kubectl run falco-pod-deleted --image=mirror.gcr.io/library/alpine:3.22 -- /bin/sh -c "while true; do sleep 3600; done"
kubectl delete pod falco-pod-deleted --grace-period=0

kevt and serviceaccount and kcreate and system_namespace and response_successful

Service account created in kube namespace (user=%ka.user.name serviceaccount=%ka.target.name resource=%ka.target.resource ns=%ka.target.namespace sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl -n default delete serviceaccount falco-system-sa-1 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl -n default create serviceaccount falco-system-sa-1
kubectl -n default delete serviceaccount falco-system-sa-1

trap 'kubectl -n kube-public delete serviceaccount falco-system-sa-2 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl -n kube-public create serviceaccount falco-system-sa-2
kubectl -n kube-public delete serviceaccount falco-system-sa-2

trap 'kubectl -n kube-system delete serviceaccount falco-system-sa-3 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl -n kube-system create serviceaccount falco-system-sa-3
kubectl -n kube-system delete serviceaccount falco-system-sa-3

trap 'kubectl -n d8-system delete serviceaccount falco-system-sa-4 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl -n d8-system create serviceaccount falco-system-sa-4
kubectl -n d8-system delete serviceaccount falco-system-sa-4

kactivity and clusterrolebinding and kcreate and ka.req.binding.role=cluster-admin

Cluster Role Binding to cluster-admin role (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource subjects=%ka.req.binding.subjects role=%ka.req.binding.role resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete clusterrolebinding falco-cluster-admin-binding --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrolebinding falco-cluster-admin-binding --clusterrole=cluster-admin --serviceaccount=default:test
kubectl delete clusterrolebinding falco-cluster-admin-binding

kevt and (role or clusterrole) and kcreate and role_with_wildcard

Created Role/ClusterRole with wildcard (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource rules=%ka.req.role.rules sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete role falco-wildcard-role-1 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-wildcard-role-1 --verb=create --resource=*
kubectl delete role falco-wildcard-role-1

trap 'kubectl delete role falco-wildcard-role-2 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-wildcard-role-2 --verb=* --resource=pod
kubectl delete role falco-wildcard-role-2

trap 'kubectl delete role falco-wildcard-role-3 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-wildcard-role-3 --verb=* --resource=*
kubectl delete role falco-wildcard-role-3

kevt and (jevt.value[/verb] in (get,create,connect)) and (jevt.value[/requestURI] contains "/pods/") and (jevt.value[/requestURI] contains "/exec" or jevt.value[/requestURI] contains "/attach") and not (jevt.value[/impersonatedUser/username] exists and jevt.value[/impersonatedUser/username] in (exec_attach_allowed_users))

Attach/Exec to pod (user=%jevt.value[/user/username] pod=%jevt.value[/objectRef/name] resource=%jevt.value[/objectRef/resource] ns=%jevt.value[/objectRef/namespace] action=%jevt.value[/objectRef/subresource] container_name=%ka.uri.param[container] command=%ka.uri.param[command] sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

cleanup() {
  kubectl delete rolebinding falco-exec-user-exec falco-exec-user-pods --ignore-not-found
  kubectl delete role falco-exec-user-exec falco-exec-user-pods --ignore-not-found
  kubectl delete serviceaccount falco-exec-user --ignore-not-found
  kubectl delete pod falco-exec-target --ignore-not-found --grace-period=0
}
# kubectl in a pod drops its in-cluster configuration once --as is given
# and sends the request to http://localhost:8080, so name the API server and the token.
kubectl_as() {
  as=$1
  shift
  sa=/var/run/secrets/kubernetes.io/serviceaccount
  kubectl --server="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" --certificate-authority="$sa/ca.crt" --token="$(cat "$sa/token")" --as="$as" "$@"
}
trap 'cleanup >/dev/null 2>&1 || true' EXIT
kubectl run falco-exec-target --image=mirror.gcr.io/library/ubuntu:24.04 -- /bin/sh -c "while true; do sleep 3600; done"
kubectl create serviceaccount falco-exec-user
kubectl create role falco-exec-user-pods --verb=get,list --resource=pods
kubectl create role falco-exec-user-exec --verb=create,get --resource=pods/exec,pods/attach
kubectl create rolebinding falco-exec-user-pods --role=falco-exec-user-pods --serviceaccount=default:falco-exec-user
kubectl create rolebinding falco-exec-user-exec --role=falco-exec-user-exec --serviceaccount=default:falco-exec-user
kubectl wait pod/falco-exec-target --for=condition=Ready --timeout=60s
kubectl_as system:serviceaccount:default:falco-exec-user exec falco-exec-target -- ls

kevt and pod_subresource and kmodify and ka.target.subresource in (ephemeralcontainers)

Ephemeral container is created in pod (user=%ka.user.name pod=%ka.target.name resource=%ka.target.resource ns=%ka.target.namespace ephemeral_container_name=%jevt.value[/requestObject/spec/ephemeralContainers/0/name] ephemeral_container_image=%jevt.value[/requestObject/spec/ephemeralContainers/0/image] sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete pod falco-debug-target --ignore-not-found --grace-period=0 >/dev/null 2>&1 || true' EXIT
kubectl run falco-debug-target --image=mirror.gcr.io/library/ubuntu:24.04 -- /bin/sh -c "while true; do sleep 3600; done"
kubectl wait pod/falco-debug-target --for=condition=Ready --timeout=60s
kubectl debug falco-debug-target --image=mirror.gcr.io/library/alpine:3.22 --target=falco-debug-target

kevt and (role or clusterrole) and kcreate and role_with_write_privs and not role_with_wildcard and not role_with_pod_exec

Created Role/ClusterRole with write privileges (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource rules=%ka.req.role.rules sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete role falco-write-role --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-write-role --verb=create,delete --resource=pods
kubectl delete role falco-write-role

trap 'kubectl delete clusterrole falco-write-clusterrole --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrole falco-write-clusterrole --verb=create,delete --resource=pods
kubectl delete clusterrole falco-write-clusterrole

kevt and (jevt.value[/stage]=ResponseComplete) and (jevt.value[/verb]=create) and (jevt.value[/objectRef/resource] in (roles,clusterroles) or jevt.value[/requestURI] contains "/roles" or jevt.value[/requestURI] contains "/clusterroles") and role_with_pod_exec and not (jevt.value[/requestObject/rules] contains "\"*\"" or jevt.value[/requestObject] contains "\"*\"") and not (jevt.value[/impersonatedUser/username] exists and jevt.value[/impersonatedUser/username] in (exec_attach_allowed_users))

Created Role/ClusterRole with pod exec privileges (user=%jevt.value[/user/username] role=%jevt.value[/objectRef/name] resource=%jevt.value[/objectRef/resource] rules=%jevt.value[/requestObject/rules] sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

cleanup() {
  kubectl delete role falco-pod-exec-role --ignore-not-found
  kubectl delete rolebinding falco-role-manager falco-role-pod-exec --ignore-not-found
  kubectl delete role falco-role-manager falco-role-pod-exec --ignore-not-found
}
# kubectl in a pod drops its in-cluster configuration once --as is given
# and sends the request to http://localhost:8080, so name the API server and the token.
kubectl_as() {
  as=$1
  shift
  sa=/var/run/secrets/kubernetes.io/serviceaccount
  kubectl --server="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" --certificate-authority="$sa/ca.crt" --token="$(cat "$sa/token")" --as="$as" "$@"
}
trap 'cleanup >/dev/null 2>&1 || true' EXIT
kubectl create role falco-role-manager --verb=create,delete --resource=roles
kubectl create role falco-role-pod-exec --verb=create --resource=pods/exec
kubectl create rolebinding falco-role-manager --role=falco-role-manager --serviceaccount=default:falco-role-user
kubectl create rolebinding falco-role-pod-exec --role=falco-role-pod-exec --serviceaccount=default:falco-role-user
if ! kubectl_as system:serviceaccount:default:falco-role-user create role falco-pod-exec-role --verb=create --resource=pods/exec; then
  echo "system:serviceaccount:default:falco-role-user could not create the role falco-pod-exec-role with pods/exec" >&2
  exit 1
fi
kubectl_as system:serviceaccount:default:falco-role-user delete role falco-pod-exec-role

cleanup() {
  kubectl delete clusterrole falco-pod-exec-clusterrole --ignore-not-found
  kubectl delete clusterrolebinding falco-clusterrole-manager falco-clusterrole-pod-exec --ignore-not-found
  kubectl delete clusterrole falco-clusterrole-manager falco-clusterrole-pod-exec --ignore-not-found
}
# kubectl in a pod drops its in-cluster configuration once --as is given
# and sends the request to http://localhost:8080, so name the API server and the token.
kubectl_as() {
  as=$1
  shift
  sa=/var/run/secrets/kubernetes.io/serviceaccount
  kubectl --server="https://${KUBERNETES_SERVICE_HOST}:${KUBERNETES_SERVICE_PORT}" --certificate-authority="$sa/ca.crt" --token="$(cat "$sa/token")" --as="$as" "$@"
}
trap 'cleanup >/dev/null 2>&1 || true' EXIT
kubectl create clusterrole falco-clusterrole-manager --verb=create,delete --resource=clusterroles
kubectl create clusterrole falco-clusterrole-pod-exec --verb=create --resource=pods/exec
kubectl create clusterrolebinding falco-clusterrole-manager --clusterrole=falco-clusterrole-manager --serviceaccount=default:falco-clusterrole-user
kubectl create clusterrolebinding falco-clusterrole-pod-exec --clusterrole=falco-clusterrole-pod-exec --serviceaccount=default:falco-clusterrole-user
if ! kubectl_as system:serviceaccount:default:falco-clusterrole-user create clusterrole falco-pod-exec-clusterrole --verb=create --resource=pods/exec; then
  echo "system:serviceaccount:default:falco-clusterrole-user could not create the clusterrole falco-pod-exec-clusterrole with pods/exec" >&2
  exit 1
fi
kubectl_as system:serviceaccount:default:falco-clusterrole-user delete clusterrole falco-pod-exec-clusterrole

kevt and (role or clusterrole) and (kmodify or kdelete) and (ka.target.name startswith "system:") and not ka.target.name in (system:coredns, system:managed-certificate-controller)

System ClusterRole/Role modified or deleted (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource action=%ka.verb sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl -n kube-system delete role system:test1 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl -n kube-system create role system:test1 --verb=create --resource=pods
kubectl -n kube-system delete role system:test1

trap 'kubectl delete clusterrole system:test2 --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrole system:test2 --verb=create --resource=pods
kubectl delete clusterrole system:test2

kactivity and kcreate and serviceaccount and not system_namespace and response_successful

K8s Serviceaccount Created (user=%ka.user.name serviceaccount=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete namespace falco-sa-created --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl get namespace falco-sa-created >/dev/null 2>&1 || kubectl create namespace falco-sa-created
kubectl -n falco-sa-created create serviceaccount falco-sa-created
kubectl -n falco-sa-created delete serviceaccount falco-sa-created

kactivity and writable_verbs and moduleconfig and response_successful

K8s ModuleConfig changed (user=%ka.user.name verb=%ka.verb moduleconfig=%ka.target.name resource=%ka.target.resource ns=%ka.target.namespace resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

kubectl annotate moduleconfig runtime-audit-engine falco-test.deckhouse.io/touched=true --overwrite
kubectl annotate moduleconfig runtime-audit-engine falco-test.deckhouse.io/touched-

kactivity and kdelete and serviceaccount and response_successful

K8s Serviceaccount Deleted (user=%ka.user.name serviceaccount=%ka.target.name ns=%ka.target.namespace resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete serviceaccount falco-sa-deleted --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create serviceaccount falco-sa-deleted
kubectl delete serviceaccount falco-sa-deleted

kactivity and kcreate and (clusterrole or role) and response_successful and not role_with_wildcard and not role_with_pod_exec and not role_with_write_privs

K8s Cluster Role Created (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource rules=%ka.req.role.rules resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete role falco-role-created --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-role-created --verb=get --resource=pods
kubectl delete role falco-role-created

trap 'kubectl delete clusterrole falco-clusterrole-created --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrole falco-clusterrole-created --verb=get --resource=pods
kubectl delete clusterrole falco-clusterrole-created

kactivity and kdelete and (clusterrole or role) and response_successful and not (ka.target.name startswith "system:")

K8s Cluster Role Deleted (user=%ka.user.name role=%ka.target.name resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete role falco-role-deleted --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create role falco-role-deleted --verb=create --resource=pods
kubectl delete role falco-role-deleted

trap 'kubectl delete clusterrole falco-clusterrole-deleted --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrole falco-clusterrole-deleted --verb=create --resource=pods
kubectl delete clusterrole falco-clusterrole-deleted

kactivity and kcreate and clusterrolebinding and response_successful and not ka.req.binding.role=cluster-admin

K8s Cluster Role Binding Created (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource subjects=%ka.req.binding.subjects role=%ka.req.binding.role resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete clusterrolebinding falco-crb-created --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrolebinding falco-crb-created --clusterrole=view --serviceaccount=default:test
kubectl delete clusterrolebinding falco-crb-created

kactivity and kdelete and clusterrolebinding and response_successful

K8s Cluster Role Binding Deleted (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl delete clusterrolebinding falco-crb-deleted --ignore-not-found >/dev/null 2>&1 || true' EXIT
kubectl create clusterrolebinding falco-crb-deleted --clusterrole=view --serviceaccount=default:test
kubectl delete clusterrolebinding falco-crb-deleted

fd.name startswith /var/lib/containerd/io.containerd.grpc.v1.cri/containers/ and open_read and not (proc.name in (allowed_proc_names) or proc.pname in (allowed_proc_names) or containerd_allowed_paths)

File below a known containerd directory opened for reading (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline proc.aname[1]=%proc.aname[1] gparent=%proc.aname[2] proc.aname[3]=%proc.aname[3] vpid=%proc.vpid container_id=%container.id image=%container.image.repository)

mkdir -p /var/lib/containerd/io.containerd.grpc.v1.cri/containers
echo "Hello Falco!" > /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-read-test
cat /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-read-test
rm /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-read-test

fd.directory startswith /var/lib/containerd and open_write and not (proc.name in (allowed_proc_names) or proc.pname in (allowed_proc_names) or containerd_allowed_paths)

File below a known containerd directory opened for writing (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid file=%fd.name parent=%proc.pname pcmdline=%proc.pcmdline proc.aname[1]=%proc.aname[1] gparent=%proc.aname[2] proc.aname[3]=%proc.aname[3] vpid=%proc.vpid container_id=%container.id image=%container.image.repository)

mkdir -p /var/lib/containerd/io.containerd.grpc.v1.cri/containers
echo Hello Falco! > /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-write-test
cat /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-write-test
rm /var/lib/containerd/io.containerd.grpc.v1.cri/containers/falco-write-test

kactivity and kcreate and pod and response_successful and system_namespace and not (ka.req.container.image contains @sha256:) and not (ka.target.namespace="d8-system" and ka.target.name startswith "deckhouse-")

Not all containers are running with the sha256 sum as a tag in a system namespace, which is a potential integrity control mechanism misconfiguration (user=%ka.user.name binding=%ka.target.name resource=%ka.target.resource resp=%ka.response.code decision=%ka.auth.decision reason=%ka.auth.reason image=%ka.req.pod.containers.image sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

trap 'kubectl -n d8-system delete pod falco-tag-not-sha256 --ignore-not-found --grace-period=0 >/dev/null 2>&1 || true' EXIT
kubectl -n d8-system run falco-tag-not-sha256 --image=mirror.gcr.io/library/ubuntu:24.04 --override-type=strategic --overrides='{"spec":{"securityContext":{"runAsNonRoot":true,"runAsUser":65534,"seccompProfile":{"type":"RuntimeDefault"}},"containers":[{"name":"falco-tag-not-sha256","securityContext":{"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]}}}]}}' -- /bin/sh -c "while true; do sleep 3600; done"
kubectl -n d8-system delete pod falco-tag-not-sha256 --grace-period=0

evt.type in (accept,listen) and fd.sport=22 and proc.name=sshd

Inbound SSH Connection Attempt (src_ip=%fd.cip connection=%fd.name container_id=%container.id)

set -eu

USER_NAME=falco-test-attempt
KEY=./id_ed25519_attempt

rm -f "$KEY" "$KEY.pub"
ssh-keygen -t ed25519 -N '' -f "$KEY" -q

kubectl apply -f -<<EOF
apiVersion: deckhouse.io/v1
kind: NodeUser
metadata:
  name: $USER_NAME
spec:
  isSudoer: false
  nodeGroups:
  - '*'
  sshPublicKeys:
  - $(cat "$KEY.pub")
  uid: 1224
EOF

trap 'kubectl delete nodeuser/$USER_NAME --ignore-not-found >/dev/null 2>&1 || true' EXIT

# A node without an ExternalIP is reached at its InternalIP, which a pod can reach too.
NODE_IP=$(kubectl get nodes -l node.deckhouse.io/deckhouse-ready=true -o json | jq -r '[.items[].status.addresses[]? | select(.type=="ExternalIP") | .address] + [.items[].status.addresses[]? | select(.type=="InternalIP") | .address] | .[0] // empty')
if [ -z "$NODE_IP" ]; then
  echo "no Ready node exposes an ExternalIP or an InternalIP, cannot test inbound SSH" >&2
  exit 1
fi

# Provisioning the NodeUser onto the node is asynchronous, and the object
# carries no condition to wait on - "kubectl wait --for=jsonpath=
# '{.metadata.name}'=$USER_NAME" only asserts the name equals itself and
# returns at once. So poll the login instead of sleeping a fixed guess:
# until the key reaches the node the login gets refused, which produces a
# connection attempt but no shell, and reports as "Cmd: OK, Log: FAIL".
i=0
until ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o ConnectTimeout=10 -i "$KEY" "$USER_NAME@$NODE_IP" true 2>/dev/null; do
  i=$((i + 1))
  if [ "$i" -ge 30 ]; then
    echo "$USER_NAME could not log in to $NODE_IP after $((i * 10))s; the NodeUser never reached the node" >&2
    exit 1
  fi
  sleep 10
done

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -i "$KEY" "$USER_NAME@$NODE_IP" "ls -la && sleep 30"

spawned_process and proc.pname=sshd and not proc.name in (sshd, ssh-keygen, sshd-keygen)

Inbound SSH Connection (user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid command=%proc.cmdline pid=%proc.pid shell=%proc.name parent=%proc.pname src_ip=%fd.cip connection=%fd.name container_id=%container.id)

set -eu

USER_NAME=falco-test-login
KEY=./id_ed25519_login

rm -f "$KEY" "$KEY.pub"
ssh-keygen -t ed25519 -N '' -f "$KEY" -q

kubectl apply -f -<<EOF
apiVersion: deckhouse.io/v1
kind: NodeUser
metadata:
  name: $USER_NAME
spec:
  isSudoer: false
  nodeGroups:
  - '*'
  sshPublicKeys:
  - $(cat "$KEY.pub")
  uid: 1225
EOF

trap 'kubectl delete nodeuser/$USER_NAME --ignore-not-found >/dev/null 2>&1 || true' EXIT

# A node without an ExternalIP is reached at its InternalIP, which a pod can reach too.
NODE_IP=$(kubectl get nodes -l node.deckhouse.io/deckhouse-ready=true -o json | jq -r '[.items[].status.addresses[]? | select(.type=="ExternalIP") | .address] + [.items[].status.addresses[]? | select(.type=="InternalIP") | .address] | .[0] // empty')
if [ -z "$NODE_IP" ]; then
  echo "no Ready node exposes an ExternalIP or an InternalIP, cannot test inbound SSH" >&2
  exit 1
fi

# Provisioning the NodeUser onto the node is asynchronous, and the object
# carries no condition to wait on - "kubectl wait --for=jsonpath=
# '{.metadata.name}'=$USER_NAME" only asserts the name equals itself and
# returns at once. So poll the login instead of sleeping a fixed guess:
# until the key reaches the node the login gets refused, which produces a
# connection attempt but no shell, and reports as "Cmd: OK, Log: FAIL".
i=0
until ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -o ConnectTimeout=10 -i "$KEY" "$USER_NAME@$NODE_IP" true 2>/dev/null; do
  i=$((i + 1))
  if [ "$i" -ge 30 ]; then
    echo "$USER_NAME could not log in to $NODE_IP after $((i * 10))s; the NodeUser never reached the node" >&2
    exit 1
  fi
  sleep 10
done

ssh -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null -o BatchMode=yes -i "$KEY" "$USER_NAME@$NODE_IP" "ls -la && sleep 30"

ka.response.code=401 and not jevt.value[/requestURI] startswith /version and not jevt.value[/requestURI] in (/healthz, /readyz, /livez)

Unauthorized K8s API request detected
user=%jevt.value[/user/username]
agents=%jevt.value[/userAgent]
verb=%jevt.value[/verb]
uri=%jevt.value[/requestURI]
src_ip=%jevt.value[/sourceIPs]
dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0]
dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0]

curl -k https://$(kubectl -n default get svc kubernetes -o json | jq -r ".spec.clusterIP")/auth/test -H 'Authorization: Bearer TEST'

kevt and kcreate and ka.target.resource in (security_reports)

K8s Security Reports Created. The report may contain vulnerability information. Check the object in the cluster (user=%ka.user.name, verb=%ka.verb, ns=%ka.target.namespace, resource=%ka.target.resource, object=%ka.target.name sourceIP=%jevt.value[/sourceIPs] dex_name=%jevt.value[/user/extra/user-authn.deckhouse.io~1name/0] dex_provider=%jevt.value[/user/extra/user-authn.deckhouse.io~1dex-provider/0])

open_write_append and bin_dir and proc_name

Deckhouse binary %fd.name is missing a proper digital signature

kevt and jevt.value[/annotations/deckhouse.io~1signature] exists

K8s audit event with deckhouse.io/signature annotation. Indicates that unsigned objects or objects with invalid signatures were found in the etcd database. (user=%ka.user.name verb=%ka.verb resource=%ka.target.resource object=%ka.target.name signature=%jevt.value[/annotations/deckhouse.io~1signature])