Falcoを試す - sotoiwa’s blog

Falcoを試したメモ。

参考リンク

インストール

DaemonSetとしてインストールすることもできるが、ここではスタンドアローンでインストールする。

https://falco.org/docs/getting-started/installation/

curl -s https://falco.org/repo/falcosecurity-3672BA8F.asc | apt-key add -
echo "deb https://dl.bintray.com/falcosecurity/deb stable main" | tee -a /etc/apt/sources.list.d/falcosecurity.list
apt-get update -y

カーネルヘッダーをインストールする。

apt-get -y install linux-headers-$(uname -r)

Falcoをインストールする。

apt-get -y install linux-headers-$(uname -r)

Falcoを起動する。

service falco start

/etc/falcoに設定ファイルがある。falco.yamlがメインの設定ファイルで、デフォルトだと、syslogとstdoutにログを出すようになっている。

root@cks-worker:/etc/falco# ls -l
total 172
-rw-r--r-- 1 root root   7834 Nov 10 10:54 falco.yaml
-rw-r--r-- 1 root root   1136 Nov 10 10:54 falco_rules.local.yaml
-rw-r--r-- 1 root root 126820 Nov 10 10:54 falco_rules.yaml
-rw-r--r-- 1 root root  25941 Nov 10 10:54 k8s_audit_rules.yaml
drwxr-xr-x 2 root root   4096 Jan  2 22:31 rules.available
drwxr-xr-x 2 root root   4096 Nov 10 11:13 rules.d

動作確認

syslogをtailしておく。

tail -f /var/log/syslog | grep falco

MasterノードでPodにexecしてみる。

root@cks-master:~# k get pod
NAME     READY   STATUS    RESTARTS   AGE
apache   1/1     Running   0          35m
root@cks-master:~# k exec -it apache -- bash
root@apache:/usr/local/apache2#

するとFalcoにはこんなログがでる。

Jan  2 22:46:24 cks-worker falco: 22:46:24.888113023: Notice A shell was spawned in a container with an attached terminal (user=root user_loginuid=-1 k8s_apache_apache_default_1242dd92-096b-48e7-a1e5-d22fd4f9825f_0 (id=0f8159e4e139) shell=bash parent=runc cmdline=bash terminal=34816 container_id=0f8159e4e139 image=httpd)

/etc/passwordに書き込みしようとしてみる。

root@apache:/usr/local/apache2# echo user >> /etc/password
root@apache:/usr/local/apache2#

するとFalcoにはこんなログがでる。

Jan  2 22:49:27 cks-worker falco: 22:49:27.421935717: Error File below /etc opened for writing (user=root user_loginuid=-1 command=bash parent=<NA> pcmdline=<NA> file=/etc/password program=bash gparent=<NA> ggparent=<NA> gggparent=<NA> container_id=0f8159e4e139 image=httpd)

apt-getを実行してみる。

root@apache:/usr/local/apache2# apt-get update
Get:1 http://security.debian.org/debian-security buster/updates InRelease [65.4 kB]
Get:2 http://deb.debian.org/debian buster InRelease [121 kB]
Get:3 http://deb.debian.org/debian buster-updates InRelease [51.9 kB]
Get:4 http://security.debian.org/debian-security buster/updates/main amd64 Packages [260 kB]
Get:5 http://deb.debian.org/debian buster/main amd64 Packages [7907 kB]
Get:6 http://deb.debian.org/debian buster-updates/main amd64 Packages [7860 B]
Fetched 8414 kB in 2s (3423 kB/s)
Reading package lists... Done
root@apache:/usr/local/apache2#

するとFalcoにはこんなログがでる。

Jan  2 22:51:06 cks-worker falco: 22:51:06.565891549: Error Package management process launched in container (user=root user_loginuid=-1 command=apt-get update container_id=0f8159e4e139 container_name=k8s_apache_apache_default_1242dd92-096b-48e7-a1e5-d22fd4f9825f_0 image=httpd:latest)

PodのreadinessProbeでコマンドを実行してみる。

apiVersion: v1
kind: Pod
metadata:
  creationTimestamp: null
  labels:
    run: apache
  name: apache
spec:
  containers:
  - image: httpd
    name: apache
    resources: {}
    readinessProbe:
      exec:
        command:
        - apt-get
        - update
      initialDelaySeconds: 5
      periodSeconds: 3
  dnsPolicy: ClusterFirst
  restartPolicy: Always
status: {}

この場合でも同じようにFalcoにログがでる。

Jan  2 22:56:06 cks-worker falco: 22:56:06.349310345: Error Package management process launched in container (user=root user_loginuid=-1 command=apt-get update container_id=cc0605759550 container_name=k8s_apache_apache_default_74f6acdf-0f91-499b-94b9-6153771a0c20_0 image=httpd:latest)
Jan  2 22:56:09 cks-worker falco: 22:56:09.393097989: Error Package management process launched in container (user=root user_loginuid=-1 command=apt-get update container_id=cc0605759550 container_name=k8s_apache_apache_default_74f6acdf-0f91-499b-94b9-6153771a0c20_0 image=httpd:latest)
Jan  2 22:56:12 cks-worker falco: 22:56:12.349548427: Error Package management process launched in container (user=root user_loginuid=-1 command=apt-get update container_id=cc0605759550 container_name=k8s_apache_apache_default_74f6acdf-0f91-499b-94b9-6153771a0c20_0 image=httpd:latest)

ルールの確認

先ほどのA shell was spawned in a container with an attached terminalは/etc/falco/falco_rules.yamlに以下のようなルールがある。ルールの前後には関連するマクロやリストが定義されている。

- rule: Terminal shell in container
  desc: A shell was used as the entrypoint/exec point into a container with an attached terminal.
  condition: >
    spawned_process and container
    and shell_procs and proc.tty != 0
    and container_entrypoint
    and not user_expected_terminal_shell_in_container_conditions
  output: >
    A shell was spawned in a container with an attached terminal (user=%user.name user_loginuid=%user.loginuid %container.info
    shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository)
  priority: NOTICE
  tags: [container, shell, mitre_execution]

File below /etc opened for writingは以下のルール。

- rule: Write below etc
  desc: an attempt to write to any file below /etc
  condition: write_etc_common
  output: "File below /etc opened for writing (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline parent=%proc.pname pcmdline=%proc.pcmdline file=%fd.name program=%proc.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] container_id=%container.id image=%container.image.repository)"
  priority: ERROR
  tags: [filesystem, mitre_persistence]

Package management process launched in containerは以下のルール。

# Container is supposed to be immutable. Package management should be done in building the image.
- rule: Launch Package Management Process in Container
  desc: Package management process ran inside container
  condition: >
    spawned_process
    and container
    and user.name != "_apt"
    and package_mgmt_procs
    and not package_mgmt_ancestor_procs
    and not user_known_package_manager_in_container
  output: >
    Package management process launched in container (user=%user.name user_loginuid=%user.loginuid
    command=%proc.cmdline container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
  priority: ERROR
  tags: [process, mitre_persistence]

Kubernetesの監査ログをソースとするルールはk8s_audit_rules.yamlに記載されている。例えば以下のようなもの。

- rule: Disallowed K8s User
  desc: Detect any k8s operation by users outside of an allowed set of users.
  condition: kevt and non_system_user and not ka.user.name in (allowed_k8s_users)
  output: K8s Operation performed by user not in allowed list of users (user=%ka.user.name target=%ka.target.name/%ka.target.resource verb=%ka.verb uri=%ka.uri resp=%ka.response.code)
  priority: WARNING
  source: k8s_audit
  tags: [k8s]

ルールを変えてみる

A shell was spawned in a container with an attached terminalのルールの出力を変えてみる。falco_rules.yamlから以下のセクションをコピーする。

- rule: Terminal shell in container
  desc: A shell was used as the entrypoint/exec point into a container with an attached terminal.
  condition: >
    spawned_process and container
    and shell_procs and proc.tty != 0
    and container_entrypoint
    and not user_expected_terminal_shell_in_container_conditions
  output: >
    A shell was spawned in a container with an attached terminal (user=%user.name user_loginuid=%user.loginuid %container.info
    shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty container_id=%container.id image=%container.image.repository)
  priority: NOTICE
  tags: [container, shell, mitre_execution]

falco_rules.local.yamlにペーストして書き換える。使えるフィールドは以下に記載がある。

https://falco.org/docs/rules/supported-fields/

- rule: Terminal shell in container
  desc: A shell was used as the entrypoint/exec point into a container with an attached terminal.
  condition: >
    spawned_process and container
    and shell_procs and proc.tty != 0
    and container_entrypoint
    and not user_expected_terminal_shell_in_container_conditions
  output: >
    %evt.time,%user.name,%container.name,%container.id
  priority: WARNING
  tags: [container, shell, mitre_execution]

これでFalcoを再起動して、Podにログインしてログを確認する。

Jan  2 23:39:52 cks-worker falco: 23:39:52.101704457: Warning 23:39:52.101704457,root,k8s_apache_apache_default_ec0dcb5e-4a6a-4cc1-867e-9ccf83316da2_0,8795050a0406