Psp rules support #826

mstemm · 2019-09-10T00:34:17Z

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

/kind flaky-test

If contributing rules or changes to rules, please make sure to also uncomment one of the following line:

/kind rule-update

/kind rule-create

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area engine

/area rules

/area deployment

/area integrations

/area examples

What this PR does / why we need it:

Add support for converting K8s Pod Security Policies (PSPs) into set of falco rules that can be used to evaluate the conditions specified in the PSP.

See #825 for the feature proposal.

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

Does this PR introduce a user-facing change?:

Add support for converting K8s Pod Security Policies (PSPs) into set of falco rules that can be used to evaluate the conditions specified in the PSP.

mstemm · 2019-09-10T00:40:17Z

The tests will fail until draios/sysdig#1501 is merged.

Kaizhe · 2019-09-23T16:58:20Z

@mstemm , would you please add a test case for requiredDropCapabilities?

fntlnz · 2019-09-24T16:59:09Z

I commented very extensively about this in the proposal here #825 (review)

Summary is that I don't think that doing this is responsibility of Falco directly (but please refer to the review in the proposal for more details)

For this reason I think that this must be discussed in the repo planning meeting, I'm sure others will find useful to understand this better too.

mstemm · 2019-09-24T17:49:28Z

The feedback about who does the conversion is good and we can continue the discussion there.

A lot of this PR is changes separate from the mechanics of converting a PSP to falco rules, though. Separate from that code, there's a whole new set of filter fields and operators to look at different parts of k8s audit logs and compare them to sets of desired/forbidden ports, images, etc. I'd encourage you to look at that code as well, as it would be in falco regardless of where the conversion occurs.

fntlnz · 2019-09-25T07:27:52Z

@mstemm in general I really like what you did here and having this new feature in Falco.

However since this is a big improvement we need to take a look at it a bit closer than usual, with the rest of the community too.

The conversion part is the only I have concerns about (because I have different opinions on where it can be done).

fntlnz · 2019-09-25T07:28:37Z

.travis.yml

@@ -20,7 +20,7 @@ compiler: gcc
 env:
    - BUILD_TYPE=debug
    - BUILD_TYPE=release
-sudo: required
+dist: xenial


Why did you do this? Was missing before or it's a new requirement?

It was required to get travis tests to pass. I don't really know why I had to force travis to use xenial, as https://blog.travis-ci.com/2019-04-15-xenial-default-build-environment says xenial is the default if unspecified. The commit msg for 4c820a6 has a bit more detail.

rules/k8s_audit_rules.yaml

fntlnz · 2019-09-25T07:29:27Z

userspace/engine/lua/parser.lua

-  InOp = kw("in") / "in";
-  PmatchOp = kw("pmatch") / "pmatch";
+  SetOp = kw("in") / "in" +
+          kw("intersects") / "intersects" +


userspace/engine/k8s_psp.h

leodido

Thanks Mark for your huge effort !

Overall this only needs some adjustments imho. As soon you can address them we'll merge this huge work!

rules/k8s_audit_rules.yaml

leodido · 2019-09-26T10:12:42Z

userspace/engine/falco_engine.cpp

@@ -86,6 +86,28 @@ uint32_t falco_engine::engine_version()

 #define CONSOLE_LINE_LEN 79

+static void wrap_text(const std::string &str, uint32_t initial_pos, uint32_t indent, uint32_t line_len)


This function should only have the responsibility to construct the string which then can be printed.

Furthermore I'll move this in an outside file (eg., utils, with falco::engine::utils namespace maybe). WDYT

Done (just falco::utils though).

userspace/falco/falco.cpp

rules/templates/CMakeLists.txt

test/trace_files/psp/CMakeLists.txt

userspace/engine/json_evt.h

userspace/engine/json_evt.cpp

mstemm · 2019-10-14T20:47:41Z

Looks like all the tests are passing now. Can I get a final lgtm so we can merge?

leodido · 2019-10-15T11:41:49Z

@mstemm PR looks very good! Thanks

Just one last thing please: could you remove the commits c78f2b0 and bae8d1b ?

Done that this PR is definitely in for me! 🎈

Instead of using a psp_conv binary built in the falco build, download falcoctl 0.0.2 and use its "falcoctl convert psp" subcommand to perform the conversion. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

mstemm · 2019-10-15T15:27:41Z

Ok, done. This will also undo the formatting for the changes I made, though. Let's make sure the tests just in case there were substantive changes in the formatting.

mstemm · 2019-10-15T17:32:47Z

...And the tests passed!

leodido

🎳 💣

poiana · 2019-10-15T17:44:53Z

LGTM label has been added.

Git tree hash: 2f92a254fd49d5573fe183da811816edb346f329

poiana · 2019-10-15T17:44:53Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leodido

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~OWNERS~~ [leodido]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

Add docs describing the changes in falcosecurity/falco#826.

Add docs describing the changes in falcosecurity/falco#826. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

As a part of the changes in #826, we added several breaking changes to rules files like renaming/removing some filter fields. This isn't ideal for customers who are using their own rules files. We shouldn't break older rules files in this way, so add some minimal backwards compatibility which adds back the fields that were removed *and* actually used in k8s_audit_rules.yaml. They have the same functionality as before. One exception is ka.req.binding.subject.has_name, which was only used in output fields for debugging and shouldn't have been in the rules file in the first place. This always returns the string "N/A".

As a part of the changes in #826, we added several breaking changes to rules files like renaming/removing some filter fields. This isn't ideal for customers who are using their own rules files. We shouldn't break older rules files in this way, so add some minimal backwards compatibility which adds back the fields that were removed *and* actually used in k8s_audit_rules.yaml. They have the same functionality as before. One exception is ka.req.binding.subject.has_name, which was only used in a single output field for debugging and shouldn't have been in the rules file in the first place. This always returns the string "N/A".

Add docs describing the changes in falcosecurity/falco#826. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

As a part of the changes in #826, we added several breaking changes to rules files like renaming/removing some filter fields. This isn't ideal for customers who are using their own rules files. We shouldn't break older rules files in this way, so add some minimal backwards compatibility which adds back the fields that were removed *and* actually used in k8s_audit_rules.yaml. They have the same functionality as before. One exception is ka.req.binding.subject.has_name, which was only used in a single output field for debugging and shouldn't have been in the rules file in the first place. This always returns the string "N/A". Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

poiana added release-note dco-signoff: yes labels Sep 10, 2019

poiana requested review from Kaizhe and leodido September 10, 2019 00:34

poiana added kind/feature kind/rule-update area/engine area/integrations size/XXL labels Sep 10, 2019

mstemm mentioned this pull request Sep 10, 2019

WIP: Psp rules support #682

Closed

mstemm force-pushed the psp-rules-support branch 2 times, most recently from 144d4f2 to 4c820a6 Compare September 12, 2019 18:11

fntlnz reviewed Sep 25, 2019

View reviewed changes

leodido added this to the 0.18.0 milestone Sep 25, 2019

leodido reviewed Sep 26, 2019

View reviewed changes

poiana added dco-signoff: no and removed dco-signoff: yes labels Oct 3, 2019

leodido modified the milestones: 0.18.0, 0.19.0 Oct 3, 2019

mstemm force-pushed the psp-rules-support branch 4 times, most recently from f7fc448 to 5836be0 Compare October 4, 2019 00:36

poiana added dco-signoff: yes and removed dco-signoff: no labels Oct 4, 2019

poiana removed the dco-signoff: yes label Oct 14, 2019

mstemm force-pushed the psp-rules-support branch from b6ff1aa to dcfe3f6 Compare October 14, 2019 18:37

poiana added dco-signoff: yes and removed dco-signoff: no labels Oct 14, 2019

Use falcoctl for psp conversion

e91562a

Instead of using a psp_conv binary built in the falco build, download falcoctl 0.0.2 and use its "falcoctl convert psp" subcommand to perform the conversion. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

mstemm force-pushed the psp-rules-support branch from dcfe3f6 to e91562a Compare October 15, 2019 15:26

leodido approved these changes Oct 15, 2019

View reviewed changes

poiana assigned leodido Oct 15, 2019

poiana added the lgtm label Oct 15, 2019

poiana added the approved label Oct 15, 2019

leodido merged commit b4fdaa3 into dev Oct 15, 2019

poiana deleted the psp-rules-support branch October 15, 2019 17:45

mstemm added a commit to falcosecurity/falco-website that referenced this pull request Oct 15, 2019

Add docs for K8s PSP Support

65f1bf9

Add docs describing the changes in falcosecurity/falco#826.

mstemm mentioned this pull request Oct 15, 2019

Add docs for K8s PSP Support falcosecurity/falco-website#93

Merged

mstemm added a commit to falcosecurity/falco-website that referenced this pull request Oct 15, 2019

Add docs for K8s PSP Support

17974b5

Add docs describing the changes in falcosecurity/falco#826. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

poiana pushed a commit to falcosecurity/falco-website that referenced this pull request Oct 18, 2019

Add docs for K8s PSP Support

abaa353

Add docs describing the changes in falcosecurity/falco#826. Signed-off-by: Mark Stemm <mark.stemm@gmail.com>

fntlnz modified the milestones: 0.19.0, 0.18.0 Oct 28, 2019

fntlnz mentioned this pull request Feb 6, 2020

memory leak while processing the audit endpoint #1040

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Psp rules support #826

Psp rules support #826

mstemm commented Sep 10, 2019

mstemm commented Sep 10, 2019

Kaizhe commented Sep 23, 2019

fntlnz commented Sep 24, 2019

mstemm commented Sep 24, 2019

fntlnz commented Sep 25, 2019

fntlnz Sep 25, 2019

mstemm Sep 25, 2019

fntlnz Sep 25, 2019

leodido left a comment

leodido Sep 26, 2019

mstemm Oct 7, 2019 •

edited

Loading

mstemm commented Oct 14, 2019

leodido commented Oct 15, 2019

mstemm commented Oct 15, 2019

mstemm commented Oct 15, 2019

leodido left a comment

poiana commented Oct 15, 2019

poiana commented Oct 15, 2019

		@@ -86,6 +86,28 @@ uint32_t falco_engine::engine_version()

		#define CONSOLE_LINE_LEN 79

		static void wrap_text(const std::string &str, uint32_t initial_pos, uint32_t indent, uint32_t line_len)

Psp rules support #826

Psp rules support #826

Conversation

mstemm commented Sep 10, 2019

mstemm commented Sep 10, 2019

Kaizhe commented Sep 23, 2019

fntlnz commented Sep 24, 2019

mstemm commented Sep 24, 2019

fntlnz commented Sep 25, 2019

fntlnz Sep 25, 2019

Choose a reason for hiding this comment

mstemm Sep 25, 2019

Choose a reason for hiding this comment

fntlnz Sep 25, 2019

Choose a reason for hiding this comment

leodido left a comment

Choose a reason for hiding this comment

leodido Sep 26, 2019

Choose a reason for hiding this comment

mstemm Oct 7, 2019 • edited Loading

Choose a reason for hiding this comment

mstemm commented Oct 14, 2019

leodido commented Oct 15, 2019

mstemm commented Oct 15, 2019

mstemm commented Oct 15, 2019

leodido left a comment

Choose a reason for hiding this comment

poiana commented Oct 15, 2019

poiana commented Oct 15, 2019

mstemm Oct 7, 2019 •

edited

Loading