Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

rule(Container Run as Root User): new rule created #1500

Merged
merged 2 commits into from
Dec 4, 2020
Merged

rule(Container Run as Root User): new rule created #1500

Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
6076fd4
rule(Container Run as Root User): new rule created
Kaizhe Dec 2, 2020
115bff8
add exception macro
Kaizhe Dec 3, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
16 changes: 16 additions & 0 deletions rules/falco_rules.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3070,6 +3070,22 @@
priority: WARNING
tags: [process]

- list: run_as_root_image_list
items: []

- macro: user_known_run_as_root_container
condition: (container.image.repository in (run_as_root_image_list))

# The rule is disabled by default and should be enabled when non-root container policy has been applied.
# Note the rule will not work as expected when usernamespace is applied, e.g. userns-remap is enabled.
- rule: Container Run as Root User
desc: Detected container running as root user
condition: spawned_process and container and proc.vpid=1 and user.uid=0 and not user_known_run_as_root_container
enabled: false
output: Container launched with root user privilege (uid=%user.uid container_id=%container.id container_name=%container.name image=%container.image.repository:%container.image.tag)
priority: INFO
tags: [container, process]

# Application rules have moved to application_rules.yaml. Please look
# there if you want to enable them by adding to
# falco_rules.local.yaml.