From d7b292fbb9d94d136427006cf409cfa78186fa12 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?N=C3=A9stor=20Salceda?= Date: Mon, 24 Feb 2020 17:22:48 +0100 Subject: [PATCH] [stable/falco] Upload to Falco 0.20.0 (#20983) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Signed-off-by: Néstor Salceda --- stable/falco/CHANGELOG.md | 7 +++++++ stable/falco/Chart.yaml | 4 ++-- stable/falco/README.md | 2 +- stable/falco/rules/falco_rules.yaml | 24 +++++++++++++++++++++--- stable/falco/values.yaml | 2 +- 5 files changed, 32 insertions(+), 7 deletions(-) diff --git a/stable/falco/CHANGELOG.md b/stable/falco/CHANGELOG.md index 489dfb8901..48914405ee 100644 --- a/stable/falco/CHANGELOG.md +++ b/stable/falco/CHANGELOG.md @@ -3,6 +3,13 @@ This file documents all notable changes to Falco Helm Chart. The release numbering uses [semantic versioning](http://semver.org). +## v1.1.2 + +### Minor Changes + +* Upgrade to Falco 0.20.0 +* Upgrade rules to Falco 0.20.0 + ## v1.1.1 ### Minor Changes diff --git a/stable/falco/Chart.yaml b/stable/falco/Chart.yaml index 316fd626ab..467af685e0 100644 --- a/stable/falco/Chart.yaml +++ b/stable/falco/Chart.yaml @@ -1,7 +1,7 @@ apiVersion: v1 name: falco -version: 1.1.1 -appVersion: 0.19.0 +version: 1.1.2 +appVersion: 0.20.0 description: Falco keywords: - monitoring diff --git a/stable/falco/README.md b/stable/falco/README.md index b856683b9a..9114ed86f5 100644 --- a/stable/falco/README.md +++ b/stable/falco/README.md @@ -47,7 +47,7 @@ The following table lists the configurable parameters of the Falco chart and the | --- | --- | --- | | `image.registry` | The image registry to pull from | `docker.io` | | `image.repository` | The image repository to pull from | `falcosecurity/falco` | -| `image.tag` | The image tag to pull | `0.19.0` | +| `image.tag` | The image tag to pull | `0.20.0` | | `image.pullPolicy` | The image pull policy | `IfNotPresent` | | `containerd.enabled` | Enable ContainerD support | `true` | | `containerd.socket` | The path of the ContainerD socket | `/run/containerd/containerd.sock` | diff --git a/stable/falco/rules/falco_rules.yaml b/stable/falco/rules/falco_rules.yaml index 75a33f154a..04ac475d95 100644 --- a/stable/falco/rules/falco_rules.yaml +++ b/stable/falco/rules/falco_rules.yaml @@ -744,7 +744,7 @@ - macro: ms_oms_writing_conf condition: > - ((proc.name in (omiagent,omsagent,in_heartbeat_r*,omsadmin.sh,PerformInventor) + ((proc.name in (omiagent,omsagent,in_heartbeat_r*,omsadmin.sh,PerformInventor,dsc_host) or proc.pname in (ms_oms_binaries) or proc.aname[2] in (ms_oms_binaries)) and (fd.name startswith /etc/opt/omi or fd.name startswith /etc/opt/microsoft/omsagent)) @@ -1156,6 +1156,16 @@ - macro: automount_using_mtab condition: (proc.pname = automount and fd.name startswith /etc/mtab) +- macro: mcafee_writing_cma_d + condition: (proc.name=macompatsvc and fd.directory=/etc/cma.d) + +- macro: avinetworks_supervisor_writing_ssh + condition: > + (proc.cmdline="se_supervisor.p /opt/avi/scripts/se_supervisor.py -d" and + (fd.name startswith /etc/ssh/known_host_ or + fd.name startswith /etc/ssh/ssh_monitor_config_ or + fd.name startswith /etc/ssh/ssh_config_)) + # Add conditions to this macro (probably in a separate file, # overwriting this macro) to allow for specific combinations of # programs writing below specific directories below @@ -1190,6 +1200,7 @@ qualys-cloud-ag, locales.postins, nomachine_binaries, adclient, certutil, crlutil, pam-auth-update, parallels_insta, openshift-launc, update-rc.d, puppet) + and not (container and proc.cmdline in ("cp /run/secrets/kubernetes.io/serviceaccount/ca.crt /etc/pki/ca-trust/source/anchors/openshift-ca.crt")) and not proc.pname in (sysdigcloud_binaries, mail_config_binaries, hddtemp.postins, sshkit_script_binaries, locales.postins, deb_binaries, dhcp_binaries) and not fd.name pmatch (safe_etc_dirs) and not fd.name in (/etc/container_environment.sh, /etc/container_environment.json, /etc/motd, /etc/motd.svc) @@ -1273,6 +1284,8 @@ and not etcd_manager_updating_dns and not user_known_write_below_etc_activities and not automount_using_mtab + and not mcafee_writing_cma_d + and not avinetworks_supervisor_writing_ssh - rule: Write below etc desc: an attempt to write to any file below /etc @@ -1340,6 +1353,9 @@ - macro: user_known_write_below_root_activities condition: (never_true) +- macro: runc_writing_exec_fifo + condition: (proc.cmdline="runc:[1:CHILD] init" and fd.name=/exec.fifo) + - rule: Write below root desc: an attempt to write to any file directly below / or /root condition: > @@ -1359,6 +1375,7 @@ and not galley_writing_state and not calico_writing_state and not rancher_writing_root + and not runc_writing_exec_fifo and not known_root_conditions and not user_known_write_root_conditions and not user_known_write_below_root_activities @@ -1529,7 +1546,7 @@ condition: > evt.type = setns and not proc.name in (docker_binaries, k8s_binaries, lxd_binaries, sysdigcloud_binaries, - sysdig, nsenter, calico, oci-umount, network_plugin_binaries) + sysdig, nsenter, calico, oci-umount, cilium-cni, network_plugin_binaries) and not proc.name in (user_known_change_thread_namespace_binaries) and not proc.name startswith "runc" and not proc.cmdline startswith "containerd" @@ -1668,7 +1685,8 @@ mesos_shell_binaries, erl_child_setup, exechealthz, PM2, PassengerWatchd, c_rehash, svlogd, logrotate, hhvm, serf, - lb-controller, nvidia-installe, runsv, statsite, erlexec) + lb-controller, nvidia-installe, runsv, statsite, erlexec, calico-node, + "puma reactor") and not proc.cmdline in (known_shell_spawn_cmdlines) and not proc.aname in (unicorn_launche) and not consul_running_net_scripts diff --git a/stable/falco/values.yaml b/stable/falco/values.yaml index ee6857fa24..a08d9a62db 100644 --- a/stable/falco/values.yaml +++ b/stable/falco/values.yaml @@ -3,7 +3,7 @@ image: registry: docker.io repository: falcosecurity/falco - tag: 0.19.0 + tag: 0.20.0 pullPolicy: IfNotPresent docker: