rules: detect pods sharing host pid and IPC namespaces

[loresuso]

What type of PR is this?

Uncomment one (or more) /kind <> lines:

/kind bug

/kind cleanup

/kind design

/kind documentation

/kind failing-test

/kind feature

If contributing rules or changes to rules, please make sure to also uncomment one of the following line:

/kind rule-update

/kind rule-create

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area build

/area engine

/area rules

/area tests

/area proposals

What this PR does / why we need it:

This PR adds two rules to detect if a pod is created and configured to share host pid and IPC namespaces. When talking about container security, namespaces play a big role, since they allow to control which resources a process in a container can actually use. Having a pod sharing pid and IPC host namespaces is a potential risk and it could be leveraged by attackers. You can read more in this well-written article.

Please, let me know if there are container images that make use of host pid and IPC namespaces and can be whitelisted. I am not aware of any atm

Which issue(s) this PR fixes:

Fixes #

Special notes for your reviewer:

I tested these new rules using KinD and installed Falco with the latest Helm chart. To configure k8s audit logs, I configured KinD with this config file:

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  kubeadmConfigPatches:
  - |
    kind: ClusterConfiguration
    apiServer:
        # enable auditing flags on the API server
        extraArgs:
          audit-log-path: /var/log/kubernetes/kube-apiserver-audit.log
          audit-policy-file: /etc/kubernetes/policies/audit-policy.yaml
        # mount new files / directories on the control plane
        extraVolumes:
          - name: audit-policies
            hostPath: /etc/kubernetes/policies
            mountPath: /etc/kubernetes/policies
            readOnly: true
            pathType: "DirectoryOrCreate"
          - name: "audit-logs"
            hostPath: "/var/log/kubernetes"
            mountPath: "/var/log/kubernetes"
            readOnly: false
            pathType: DirectoryOrCreate
  # mount the local file on the control plane
  extraMounts:
  - hostPath: ./audit-policy.yaml
    containerPath: /etc/kubernetes/policies/audit-policy.yaml
    readOnly: true
    # allow Falco to use devices provided by the kernel module
  - hostPath: /dev
    containerPath: /dev
    # allow Falco to use the Docker unix socket
  - hostPath: /var/run/docker.sock
    containerPath: /var/run/docker.sock

Then I have used FluentBit as described in this blog post on the official Falco website

Does this PR introduce a user-facing change?:

new(rules): add rules to detect pods sharing host pid and IPC namespaces 

[leogr]

/cc @Kaizhe

[Kaizhe]

can you add an exception list ? e.g. falco_hostpid_images and user_known_hostpid_images

[loresuso]

Hi @Kaizhe, I have added an empty list for both rules. If you have any suggestions on how to find out non-malicious images that make use of these namespaces to work, let me know! Thank you

[Kaizhe]

similar above

[jasondellaluce]

/milestone 0.32.0

[poiana]

LGTM label has been added.

Git tree hash: 6896a83235b7cd37c786a3d85f40769f8099fd64

[leogr]

Closing and reopening to trigger the CI
/close

[poiana]

@leogr: Closed this PR.

In response to this:

Closing and reopening to trigger the CI
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[leogr]

/reopen

[poiana]

@leogr: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[leogr]

/approve

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: leogr, loresuso

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment