From 36acd6dfbfdda840c904961c68cb17a41e72b48e Mon Sep 17 00:00:00 2001 From: Matt Moyer Date: Wed, 9 Mar 2022 21:59:41 -0600 Subject: [PATCH] Add user_known_mount_in_privileged_containers This adds a new macro `user_known_mount_in_privileged_containers` which allows the easier user-defined exclusions for the "Mount Launched in Privileged Container" rule. This would be cleaner with the exclusions feature, but this feature is not used in the default ruleset yet, if I understand correctly. Signed-off-by: Matt Moyer --- rules/falco_rules.yaml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index adb0512f..c94b167c 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -3065,6 +3065,9 @@ - macro: mount_info condition: (proc.args="" or proc.args intersects ("-V", "-l", "-h")) +- macro: user_known_mount_in_privileged_containers + condition: (never_true) + - rule: Mount Launched in Privileged Container desc: Detect file system mount happened inside a privileged container which might lead to container escape. condition: > @@ -3072,6 +3075,7 @@ and container.privileged=true and proc.name=mount and not mount_info + and not user_known_mount_in_privileged_containers output: Mount was executed inside a privileged container (user=%user.name user_loginuid=%user.loginuid command=%proc.cmdline %container.info image=%container.image.repository:%container.image.tag) priority: WARNING tags: [container, cis, mitre_lateral_movement]