- falco updates

TeamUbersmith · Jul 30, 2024 · 8bd69b8 · 8bd69b8
1 parent 72d8b9b
commit 8bd69b8
Show file tree

Hide file tree

Showing 3 changed files with 20 additions and 9 deletions.
diff --git a/roles/ubersmith/files/falco_rules.local.yaml b/roles/ubersmith/files/falco_rules.local.yaml
@@ -0,0 +1,12 @@
+- macro: uber_dir
+  condition: (fd.directory in (/var/www/ubersmith_root, /var/lib/docker/volumes/ubersmith_webroot/_data, /usr/local/ubersmith))
+
+- rule: Write below Ubersmith directory
+  desc: > 
+    Trying to write to any file below Ubersmith directories. This is an effective rule for detecting unusual behavior associated with system 
+    changes, including compliance-related cases.
+  condition: >
+    open_write and evt.dir=< 
+    and uber_dir
+  output: File below Ubersmith directory opened for writing (file=%fd.name pcmdline=%proc.pcmdline gparent=%proc.aname[2] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)
+  priority: ERROR
diff --git a/roles/ubersmith/tasks/main.yml b/roles/ubersmith/tasks/main.yml
@@ -110,6 +110,7 @@
        - "{{ ubersmith_home }}/conf/certbot/etc/renewal-hooks/deploy"
        - "{{ ubersmith_home }}/conf/certbot/log"
        - "{{ ubersmith_home }}/conf/sso"
+       - "{{ ubersmith_home }}/conf/falco"
        - "{{ ubersmith_home }}/app/custom"
        - "{{ ubersmith_home }}/app/custom/locale"
        - "{{ ubersmith_home }}/app/custom/plugins"

diff --git a/roles/ubersmith/templates/docker-compose.yml.j2 b/roles/ubersmith/templates/docker-compose.yml.j2
@@ -231,24 +231,22 @@ services:
   falco:
     image: falcosecurity/falco-no-driver:latest
     hostname: falco.{{ container_domain }}
-    cap_drop:
-     - all 
-    cap_add:
-     - sys_admin
-     - sys_resource
-     - sys_ptrace
-    command: falco -o engine.kind=ebpf
-    security_opt: 
+    privileged: true
+    security_opt:
      - apparmor:unconfined
     logging:
       driver: syslog
       options:
         tag: ubersmith/falco
+    tty: true
     volumes:
      - /var/run/docker.sock:/host/var/run/docker.sock
-     - /root/.falco:/root/.falco
      - /proc:/host/proc:ro
      - /etc:/host/etc
+     - "{{ ubersmith_home }}/conf/falco/falco_rules.local.yaml:/etc/falco/falco_rules.local.yaml"
+    depends_on:
+      web:
+        condition: service_started
   clamav:
     image: clamav/clamav:1.3_base
     hostname: clamav.{{ container_domain }}