falco setup for k8s

we need to talk to the kernel hence full-blown guest for once

as root

apt install build-essential gcc-12
/sbin/vboxconfig
lsmod | grep vboxdrv

as user

#minikube delete --all
grep ^proc /proc/cpuinfo 
minikube start --cpus=12 --driver=virtualbox
# --driver=qemu

git clone https://github.com/falcosecurity/charts.git
cd charts/charts/falco/
mv -i values.yaml values.yaml.dist
grep -vE '^$|^[[:space:]]*#' values.yaml.dist > values.yaml.clean
grep -vE '^$|^[[:space:]]*#' values.yaml.dist > values.yaml

here’s an example of tuning a specific rule to skip a false-positive – let’s say we don’t want to see the A shell was spawned in a container notice when ever it is DASH that is called (instead of BASH).

vi values-custom.yaml

tty: true

driver:
  enabled: true
  kind: modern-bpf

falco:
  json_output: true

customRules:

  false-positives.yaml: |-

    - rule: Terminal shell in container
      append: true
      condition: >
    and not proc.name = dash

now deploy the node set

helm dependency build
kubectx
kubens -c
helm uninstall falco-test
helm install --dry-run falco-test . --values=values-custom.yaml | less
helm install falco-test . --values=values-custom.yaml
helm upgrade falco-test . --values=values-custom.yaml

kubectl get nodes
kubectl get ds
kubectl get pods | grep ^falco-test
pods=`kubectl get pods | grep ^falco-test | awk '{print $1}'`
for pod in $pods; do kubectl logs $pod 2>&1 | grep -v ^Defaulted; done; unset pod
    # --tail=5

==> you should see /etc/falco/rules.d/false-positives.yaml mentioned

acceptance

#kubectl logs -l app.kubernetes.io/name=falco -f
kubectl logs -l app.kubernetes.io/instance=falco-test -f
# --all-containers

pod=`kubectl get pods | grep ^falco-test | awk '{print $1}' | head -1`
pod=`kubectl get pods | grep ^falco-test | awk '{print $1}' | tail -1`

kubectl exec -ti $pod -- bash

==> produces a shell spawn alert