mirror of
https://github.com/falcosecurity/falco.git
synced 2025-10-25 14:13:09 +00:00
c3f7d15e26
Currently, the falco event generator only generates system call activity. This adds support for k8s_audit events by adding a script + supporting k8s object files that generate activity that matches the k8s audit event ruleset. The main script is k8s_event_generator.sh, which loops over the files in the yaml subdirectory, running kubectl apply -f for each. In the interests of keeping things self-contained, all objects are created in a `falco-event-generator` namespace. This means that some activity related with cluster roles/cluster role bindings is not performed. Each k8s object has annotations that note: 1. The specific falco rules that should trigger. 2. A user-friendly message to print when apply-ing the file. You can provide a specific rule name to the script. If provided, only those objects related to that rule will trigger. The default is "all", meaning that all objects are created. The script loops forever, deleting the falco-event-generator namespace after each iteration. Additionally, the docker image has been updated to also copy the script + supporting files, as well as fetching the latest available `kubectl` binary. The entrypoint is now a script that allows choosing between: - syscall activity: run with .... "syscall" - k8s_audit activity: run with .... "k8s_audit" - spawn a shell: run with .... "bash" The default is "syscall" to preserve existing behavior. In most cases, you'll need to provide kube config files/directories that allow access to your cluster. A command like the following will work: ``` docker run -v $HOME/.kube:/root/.kube -it falcosecurity/falco-event-generator k8s_audit ``` Signed-off-by: Mark Stemm <mark.stemm@gmail.com>
22 lines
476 B
Bash
Executable File
22 lines
476 B
Bash
Executable File
#!/bin/bash
|
|
|
|
CMD=${1:-syscall}
|
|
|
|
shift
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ "$CMD" == "syscall" ]]; then
|
|
/usr/local/bin/event_generator
|
|
elif [[ "$CMD" == "k8s_audit" ]]; then
|
|
. k8s_event_generator.sh
|
|
elif [[ "$CMD" == "bash" ]]; then
|
|
bash
|
|
else
|
|
echo "Unknown command. Can be one of"
|
|
echo " \"syscall\": generate falco syscall-related activity"
|
|
echo " \"k8s_audit\": generate falco k8s audit-related activity"
|
|
echo " \"bash\": spawn a shell"
|
|
exit 1
|
|
fi
|