cleanup: remove `evt.arg.*` fields when always return `<NA>` #215

Andreagit97 · 2024-01-05T14:03:22Z

What type of PR is this?

/kind cleanup

Any specific area of the project related to this PR?

/area rules

What this PR does / why we need it:

This PR removes all evt.arg.* fields that will be always resolved as <NA>.

Related to this: #214

Which issue(s) this PR fixes:

Special notes for your reviewer:

github-actions · 2024-01-05T14:05:53Z

Rules files suggestions

falco_rules.yaml

Comparing ce6130c48fdd5dfda635cbe5982f09c4f5d9d13a with latest tag falco-rules-2.0.0

Minor changes:

Macro containerd_activities has been added

Patch changes:

Rule Contact K8S API Server From Container changed its output fields
Rule Create Symlink Over Sensitive Files changed its output fields
Rule Create Hardlink Over Sensitive Files changed its output fields
Rule Packet socket created in container changed its output fields
Rule Redirect STDOUT/STDIN to Network Connection in Container changed its output fields
Rule Linux Kernel Module Injection Detected changed its output fields
Rule PTRACE attached to process changed its output fields
Rule PTRACE anti-debug attempt changed its output fields
Rule Disallowed SSH Connection Non Standard Port changed its output fields

falco-sandbox_rules.yaml

Comparing ce6130c48fdd5dfda635cbe5982f09c4f5d9d13a with latest tag falco-sandbox-rules-2.0.0

Patch changes:

Rule Unexpected inbound connection source changed its output fields
Rule Modify binary dirs changed its output fields
Rule Mkdir binary dirs changed its output fields
Rule Launch Sensitive Mount Container changed its output fields
Rule Launch Disallowed Container changed its output fields
Rule Interpreted procs inbound network activity changed its output fields
Rule Interpreted procs outbound network activity changed its output fields
Rule Unexpected K8s NodePort Connection changed its output fields
Rule Create Hidden Files or Directories changed its output fields
Rule Detect outbound connections to common miner pool ports changed its output fields
Rule Container Drift Detected (chmod) changed its output fields
Rule Unprivileged Delegation of Page Faults Handling to a Userspace Process changed its output fields
Rule Java Process Class File Download changed its output fields
Rule BPF Program Not Profiled changed its output fields

falco-incubating_rules.yaml

Comparing ce6130c48fdd5dfda635cbe5982f09c4f5d9d13a with latest tag falco-incubating-rules-2.0.0

Minor changes:

Rule Potential Local Privilege Escalation via Environment Variables Misuse has been added
Rule Adding ssh keys to authorized_keys has been added
Macro glibc_tunables_env has been added

Patch changes:

Rule Change thread namespace changed its output fields
Rule Launch Privileged Container changed its output fields
Rule Launch Excessively Capable Container changed its output fields
Rule System procs network activity changed its output fields
Rule Unexpected UDP Traffic changed its output fields
Rule Non sudo setuid changed its output fields
Rule Contact EC2 Instance Metadata Service From Container changed its output fields
Rule Contact cloud metadata service from container changed its output fields
Rule Delete or rename shell history changed its output fields
Rule Set Setuid or Setgid bit changed its output fields
Rule Network Connection outside Local Subnet changed its output fields

Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>

Andreagit97 · 2024-01-05T14:04:36Z

rules/falco-deprecated_rules.yaml

@@ -87,7 +87,7 @@
    and ssh_port 
    and not allowed_ssh_hosts
  enabled: false
-  output: Disallowed SSH Connection (connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags %container.info)
+  output: Disallowed SSH Connection (connection=%fd.name lport=%fd.lport rport=%fd.rport fd_type=%fd.type fd_proto=fd.l4proto evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)


events like accept,accept4,listen,connect don't have a flag param so exe_flags=%evt.arg.flags will be always evaluated to <NA>. Same thing in many of the other cases in this PR

Andreagit97 · 2024-01-05T14:05:17Z

rules/falco-incubating_rules.yaml

@@ -1040,6 +1044,11 @@
 - macro: user_known_set_setuid_or_setgid_bit_conditions
  condition: (never_true)

+# todo!: the usage of `evt.arg*` filter check in the output should be avoided


Just picking this comment as random comment to provide feedback re the open item #176 (comment), can we also consistently rename it to flags=.

It's a real real bummer Falco cannot handle this gracefully, a bit disappointed and surprised. Given we won't schedule the fixes for Falco 0.37 and we probably need more discussions, yes we need to remove them in such cases.

uhm here I would prefer to remove the flags=%... output field unless it is not really necessary in the rule. I would reduce the output fields in our rules as much as possible, so if one field is not strictly necessary for the scope of the rule, I prefer to remove it. I have no strong opinions here, this was just my thought

BTW the comment here is related to another possible issue #214, that is not related to the exe_flags=%evt.arg.flags

ACK, yes I have the website PR already up to make this clear in the Style Guide.

I'll open a follow up PR to rename exe_flags to flags (unrelated to this PR) https://github.com/falcosecurity/rules/pull/215/files#r1443163428

ACK re https://github.com/falcosecurity/rules/pull/215/files#r1444885132

Andreagit97 · 2024-01-05T14:08:35Z

rules/falco_rules.yaml

-    and (evt.arg.oldpath in (sensitive_file_names))
-  output: Hardlinks created over sensitive files (target=%evt.arg.target linkpath=%evt.arg.linkpath evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags %container.info)
+    and (fs.path.source in (sensitive_file_names))
+  output: Hardlinks created over sensitive files (target=%fs.path.target linkpath=%fs.path.source evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty %container.info)


evt.arg.target and evt.arg.linkpath don't exist for link and linkat

CC @darryk10 and @loresuso to also confirm, thanks!

Actually this was a refactor mistake (by me since I had to do it all), I would instead suggest to revert to the old correct outputs: target=%evt.arg.oldpath linkpath=%evt.arg.newpath, see in the git history https://github.com/falcosecurity/rules/blob/dc90ca5e179fcf11e6a9b8486e4f23dacb613087/rules/falco_rules.yaml#L2808C126-L2808C175

Because using the new fs.path* fields would break things and it would be inconsistent with the symlink rule.

done, thank you for the feedback!

Andreagit97 · 2024-01-05T14:08:52Z

rules/falco_rules.yaml

@@ -998,11 +998,11 @@
    and privilege escalation (CVE-2020-14386) by an attacker. Noise can be reduced by using the user_known_packet_socket_binaries
    template list.
  condition: > 
-    evt.type=socket 
+    evt.type=socket and evt.dir=>


evt.arg.domain is only defined for the enter event

great catch

Andreagit97 · 2024-01-05T14:09:00Z

rules/falco_rules.yaml

    and container 
-    and evt.arg[0] contains AF_PACKET 
+    and evt.arg.domain contains AF_PACKET 


just for clarity

github-actions · 2024-01-05T14:10:55Z

Rules files suggestions

falco_rules.yaml

Comparing 64cd70c150904d2b04dc9d39ea491b995b3e3d1d with latest tag falco-rules-2.0.0

Minor changes:

Macro containerd_activities has been added

Patch changes:

Rule Contact K8S API Server From Container changed its output fields
Rule Create Symlink Over Sensitive Files changed its output fields
Rule Create Hardlink Over Sensitive Files changed its output fields
Rule Packet socket created in container changed its output fields
Rule Redirect STDOUT/STDIN to Network Connection in Container changed its output fields
Rule Linux Kernel Module Injection Detected changed its output fields
Rule PTRACE attached to process changed its output fields
Rule PTRACE anti-debug attempt changed its output fields
Rule Disallowed SSH Connection Non Standard Port changed its output fields

falco-sandbox_rules.yaml

Comparing 64cd70c150904d2b04dc9d39ea491b995b3e3d1d with latest tag falco-sandbox-rules-2.0.0

Patch changes:

Rule Unexpected inbound connection source changed its output fields
Rule Modify binary dirs changed its output fields
Rule Mkdir binary dirs changed its output fields
Rule Launch Sensitive Mount Container changed its output fields
Rule Launch Disallowed Container changed its output fields
Rule Interpreted procs inbound network activity changed its output fields
Rule Interpreted procs outbound network activity changed its output fields
Rule Unexpected K8s NodePort Connection changed its output fields
Rule Create Hidden Files or Directories changed its output fields
Rule Detect outbound connections to common miner pool ports changed its output fields
Rule Container Drift Detected (chmod) changed its output fields
Rule Unprivileged Delegation of Page Faults Handling to a Userspace Process changed its output fields
Rule Java Process Class File Download changed its output fields
Rule BPF Program Not Profiled changed its output fields

falco-incubating_rules.yaml

Comparing 64cd70c150904d2b04dc9d39ea491b995b3e3d1d with latest tag falco-incubating-rules-2.0.0

Minor changes:

Rule Adding ssh keys to authorized_keys has been added
Rule Potential Local Privilege Escalation via Environment Variables Misuse has been added
Macro glibc_tunables_env has been added

Patch changes:

Rule Change thread namespace changed its output fields
Rule Launch Privileged Container changed its output fields
Rule Launch Excessively Capable Container changed its output fields
Rule System procs network activity changed its output fields
Rule Unexpected UDP Traffic changed its output fields
Rule Non sudo setuid changed its output fields
Rule Contact EC2 Instance Metadata Service From Container changed its output fields
Rule Contact cloud metadata service from container changed its output fields
Rule Delete or rename shell history changed its output fields
Rule Set Setuid or Setgid bit changed its output fields
Rule Network Connection outside Local Subnet changed its output fields

this commit restores `target=%evt.arg.oldpath linkpath=%evt.arg.newpath` fields for the `Create Hardlink Over Sensitive Files` rule. Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com> Co-authored-by: Melissa Kilby <melissa.kilby.oss@gmail.com>

github-actions · 2024-01-08T15:28:33Z

Rules files suggestions

falco_rules.yaml

Comparing 7f560d4b569d0298239d67b0c70f2b1cc436a6e0 with latest tag falco-rules-2.0.0

Minor changes:

Macro containerd_activities has been added

Patch changes:

Rule Contact K8S API Server From Container changed its output fields
Rule Create Symlink Over Sensitive Files changed its output fields
Rule Create Hardlink Over Sensitive Files changed its output fields
Rule Packet socket created in container changed its output fields
Rule Redirect STDOUT/STDIN to Network Connection in Container changed its output fields
Rule Linux Kernel Module Injection Detected changed its output fields
Rule PTRACE attached to process changed its output fields
Rule PTRACE anti-debug attempt changed its output fields
Rule Disallowed SSH Connection Non Standard Port changed its output fields

falco-sandbox_rules.yaml

Comparing 7f560d4b569d0298239d67b0c70f2b1cc436a6e0 with latest tag falco-sandbox-rules-2.0.0

Patch changes:

Rule Unexpected inbound connection source changed its output fields
Rule Modify binary dirs changed its output fields
Rule Mkdir binary dirs changed its output fields
Rule Launch Sensitive Mount Container changed its output fields
Rule Launch Disallowed Container changed its output fields
Rule Interpreted procs inbound network activity changed its output fields
Rule Interpreted procs outbound network activity changed its output fields
Rule Unexpected K8s NodePort Connection changed its output fields
Rule Create Hidden Files or Directories changed its output fields
Rule Detect outbound connections to common miner pool ports changed its output fields
Rule Container Drift Detected (chmod) changed its output fields
Rule Unprivileged Delegation of Page Faults Handling to a Userspace Process changed its output fields
Rule Java Process Class File Download changed its output fields
Rule BPF Program Not Profiled changed its output fields

falco-incubating_rules.yaml

Comparing 7f560d4b569d0298239d67b0c70f2b1cc436a6e0 with latest tag falco-incubating-rules-2.0.0

Minor changes:

Rule Adding ssh keys to authorized_keys has been added
Rule Potential Local Privilege Escalation via Environment Variables Misuse has been added
Macro glibc_tunables_env has been added

Patch changes:

Rule Change thread namespace changed its output fields
Rule Launch Privileged Container changed its output fields
Rule Launch Excessively Capable Container changed its output fields
Rule System procs network activity changed its output fields
Rule Unexpected UDP Traffic changed its output fields
Rule Non sudo setuid changed its output fields
Rule Contact EC2 Instance Metadata Service From Container changed its output fields
Rule Contact cloud metadata service from container changed its output fields
Rule Delete or rename shell history changed its output fields
Rule Set Setuid or Setgid bit changed its output fields
Rule Network Connection outside Local Subnet changed its output fields

incertum

/approve

poiana · 2024-01-08T17:19:39Z

LGTM label has been added.

Git tree hash: 3a4203d579fd86e146560c316b9d1afa5993e130

poiana · 2024-01-08T17:19:41Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Andreagit97, incertum

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [Andreagit97,incertum]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

poiana added kind/cleanup dco-signoff: yes area/rules labels Jan 5, 2024

poiana requested review from leodido and loresuso January 5, 2024 14:03

poiana added approved size/L labels Jan 5, 2024

cleanup: remove evt.arg.* fields when always return NA

9df6092

Signed-off-by: Andrea Terzolo <andreaterzolo3@gmail.com>

Andreagit97 force-pushed the check_rules branch from b68614d to 9df6092 Compare January 5, 2024 14:09

Andreagit97 commented Jan 5, 2024

View reviewed changes

Andreagit97 mentioned this pull request Jan 5, 2024

exe_flags=%evt.arg.flags usage among our rules #213

Closed

incertum approved these changes Jan 8, 2024

View reviewed changes

poiana assigned incertum Jan 8, 2024

poiana added the lgtm label Jan 8, 2024

poiana merged commit 1221b9e into falcosecurity:main Jan 8, 2024
14 of 17 checks passed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

cleanup: remove `evt.arg.*` fields when always return `<NA>` #215

cleanup: remove `evt.arg.*` fields when always return `<NA>` #215

Andreagit97 commented Jan 5, 2024

github-actions bot commented Jan 5, 2024

Andreagit97 Jan 5, 2024

Andreagit97 Jan 5, 2024

incertum Jan 5, 2024 •

edited

Loading

Andreagit97 Jan 8, 2024

Andreagit97 Jan 8, 2024

incertum Jan 8, 2024

Andreagit97 Jan 5, 2024

incertum Jan 5, 2024

incertum Jan 6, 2024

incertum Jan 6, 2024

Andreagit97 Jan 8, 2024

Andreagit97 Jan 5, 2024

incertum Jan 5, 2024

Andreagit97 Jan 5, 2024

github-actions bot commented Jan 5, 2024

github-actions bot commented Jan 8, 2024

incertum left a comment

poiana commented Jan 8, 2024

poiana commented Jan 8, 2024

cleanup: remove evt.arg.* fields when always return <NA> #215

cleanup: remove evt.arg.* fields when always return <NA> #215

Conversation

Andreagit97 commented Jan 5, 2024

github-actions bot commented Jan 5, 2024

Rules files suggestions

falco_rules.yaml

falco-sandbox_rules.yaml

falco-incubating_rules.yaml

Choose a reason for hiding this comment

Choose a reason for hiding this comment

incertum Jan 5, 2024 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

github-actions bot commented Jan 5, 2024

Rules files suggestions

falco_rules.yaml

falco-sandbox_rules.yaml

falco-incubating_rules.yaml

github-actions bot commented Jan 8, 2024

Rules files suggestions

falco_rules.yaml

falco-sandbox_rules.yaml

falco-incubating_rules.yaml

incertum left a comment

Choose a reason for hiding this comment

poiana commented Jan 8, 2024

poiana commented Jan 8, 2024

cleanup: remove `evt.arg.*` fields when always return `<NA>` #215

cleanup: remove `evt.arg.*` fields when always return `<NA>` #215

incertum Jan 5, 2024 •

edited

Loading