False positives in GKE

[dagi3d]

Hi,
I was testing Falco in a GKE cluster and it seems that with the default rules configuration some false positives are triggered, some by performing ordinary actions and others are triggered from time to time with no intervention from my side:

I periodically get a bunch of notifications(~80x) similar to this:

16:06:27.084969768: Error File below / or /root opened for writing (user=root command=kubectl get scalingpolicies -n kube-system fluentd-gcp-scaling-policy parent=kubectl file=/root/.kube/cache/discovery/10.7.240.1_443/v1/serverresources.json.668007090 program=kubectl) k8s.pod=fluentd-gcp-scaler-7c5db745fc-k6mw9 container=d0ab88949b4c

After patching a deployment to restart the pods, I get several notifications(~10x) with a message similar to:

16:02:48.552970029: Notice Namespace change (setns) by unexpected program (user=root command=bridge  parent=bridge k8s.pod=<NA> container=host)

If I ssh to any machine of my GCP project, it seems that the keys are also added to the GKE nodes and therefore an additional alert is triggered:

Error File below a monitored directory opened for writing (user=root command=google_accounts /usr/bin/google_accounts_daemon file=/home/borja/.ssh/authorized_keys parent=systemd pcmdline=systemd  gparent=<NA>) k8s.pod=<NA> container=host

It was tested using latest version form the master branch and only change made was in falco.yml to send the alerts to Slack

[mstemm]

Thanks for the report, I've made the necessary rule changes to address these FPs. If you'd like to try them out, they're currently on the rule-updates-2018-11.v1 branch. Otherwise. We'll probably merge them in the next week or two.