False positive "setuid" notice

[CashWilliams]

Describe the bug

Running latest version, we are seeing a lot of calls reporting like:

Notice Unexpected setuid call by non-sudo, non-root program (user=<NA> user_loginuid=-1 cur_uid=0 parent=umount command=umount /var/lib/kubelet/pods/3630aac9-5810-43a9-8c81-f2ceea6f9888/volume-subpaths/77b0d7f3-62d0-4963-927c-0c680a4a77a4-files/shared-setup/14 uid=<NA> container_id=host image=<NA>) k8s.ns=<NA> k8s.pod=<NA> container=host k8s.ns=<NA> k8s.pod=<NA> container=host k8s.ns=<NA> k8s.pod=<NA> container=host

How to reproduce it

We're running on EKS, not sure if it happens on other k8s systems. One note: we are running the following patches, which might be causing some meta data to be missing that an existing rule is looking for:

• Making Kubernetes Falco support optional in the daemonset, fixing #225 charts#226
• Get k8s pod metadata and namespace name from container labels libs#15
• Parametrize the metadata download libs#40

Expected behaviour

These alerts don't happen.

Environment

• Falco version: 0.28
• System info:

• Cloud provider or hardware configuration: EKS

[leodido]

Hello @CashWilliams, could you please double-check whether @Kaizhe's PR (#1665) solves your issue?

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[poiana]

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

[poiana]

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

[poiana]

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.