Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bypass research issues #1810

Merged
merged 3 commits into from
Jan 25, 2022
Merged

Bypass research issues #1810

merged 3 commits into from
Jan 25, 2022

Conversation

sberkovich
Copy link
Contributor

@sberkovich sberkovich commented Nov 29, 2021 •
edited by leogr
Loading

What type of PR is this?

/kind rule-update
/kind rule-create

Any specific area of the project related to this PR?
/area rules

What this PR does / why we need it:
This PR is a result of the bypass research published here (for now kept private). The research introduced several new bypass techniques and expanded on several already-known bypasses.

Which issue(s) this PR fixes:
This PR touches five existing rules and introduces one new rule.

Special notes for your reviewer:
This PR does not cover the bypasses found in the original research fully. Rather it follows a low-hanging fruit approach and focuses on syntactical fixes that do not require structural changes to the rule engine or kernel probes.

Does this PR introduce a user-facing change?:

rule(Create Hardlink Over Sensitive Files): new rule to detect hard links created over sensitive files
rule(Detect crypto miners using the Stratum protocol): add `stratum2+tcp` and `stratum+ssl` protocols detection
rule(Sudo Potential Privilege Escalation): correct special case for the CVE-2021-3156 exploit

@poiana
Copy link
Contributor

poiana commented Nov 29, 2021

Welcome @sberkovich! It looks like this is your first PR to falcosecurity/falco 🎉

@poiana poiana requested review from Kaizhe and mstemm November 29, 2021 11:16
@poiana poiana added the size/M label Nov 29, 2021
@sberkovich
Copy link
Contributor Author

After the conversation with @leogr removing the commit that extended the sensitive directories macro. This leaves the symlinks creation rule open for bypass (see original research), but may result in too many FPs as circleci tests showed.

Note: reconsider expanding sensitive directory macro in the future to "contains" /etc/ and /root/

@sberkovich
Copy link
Contributor Author

/assign @mstemm

@sberkovich sberkovich marked this pull request as ready for review December 14, 2021 13:49
@leogr
Copy link
Member

leogr commented Dec 14, 2021

/kind rule-update
/kind rule-create
/area rules
/milestone 0.31.0

@poiana poiana added this to the 0.31.0 milestone Dec 14, 2021
Kaizhe
Kaizhe reviewed Dec 15, 2021
View reviewed changes
rules/falco_rules.yaml Outdated Show resolved Hide resolved
@leogr leogr requested a review from Kaizhe December 21, 2021 14:06
@leogr
Copy link
Member

leogr commented Dec 23, 2021

Hey @sberkovich

Could you rebase, please?

Kaizhe
Kaizhe reviewed Dec 24, 2021
View reviewed changes
rules/falco_rules.yaml Outdated Show resolved Hide resolved
@poiana poiana added size/M and removed size/S labels Jan 20, 2022
@leogr leogr requested review from leogr and Kaizhe January 20, 2022 13:49
@sberkovich
Copy link
Contributor Author

Guys, I'd love to get it into 0.31. Any more feedback? I'll commit as much time as needed.

@leogr leogr mentioned this pull request Jan 25, 2022
Closed
51 tasks
@sberkovich
new(rules): Create Hardlink Over Sensitive Files
8276d7a 
New rule to prevent hardlink bypass and symlink rule set to WARNING for consistency
Signed-off-by: Shay Berkovich <[email protected]>
Co-authored-by: Meera Balsara <[email protected]>
@sberkovich
rule update(Detect crypto miners using the Stratum protocol): update …
0506a23 
…protocols

Signed-off-by: Shay Berkovich <[email protected]>
Co-authored-by: Meera Balsara <[email protected]>
@sberkovich
rule update(Sudo Potential Privilege Escalation): trigger the most co…
ee3deac 
…mmon CVE-2021-3156 exploit

Signed-off-by: Shay Berkovich <[email protected]>
Co-authored-by: Meera Balsara <[email protected]>
leogr
leogr approved these changes Jan 25, 2022
View reviewed changes
Copy link
Member

@leogr leogr left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/approve

@poiana poiana added the lgtm label Jan 25, 2022
@poiana
Copy link
Contributor

poiana commented Jan 25, 2022

LGTM label has been added.

Git tree hash: 273efa984b5053069a6d6cfa0c28c95aa6b4d9d6

Kaizhe
Kaizhe approved these changes Jan 25, 2022
View reviewed changes
Copy link
Contributor

@Kaizhe Kaizhe left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

/lgtm

@poiana
Copy link
Contributor

poiana commented Jan 25, 2022

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: Kaizhe, leogr, sberkovich

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

@poiana poiana merged commit 6b9fafb into falcosecurity:master Jan 25, 2022
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@Andreagit97 Andreagit97 Andreagit97 left review comments

@Kaizhe Kaizhe Kaizhe approved these changes

@leogr leogr leogr approved these changes

@mstemm mstemm Awaiting requested review from mstemm

Assignees

@Kaizhe Kaizhe

@leogr leogr

@mstemm mstemm

Labels
approved area/rules dco-signoff: yes kind/rule-create kind/rule-update lgtm release-note size/S
Projects
None yet
Milestone
0.31.0
Development

Successfully merging this pull request may close these issues.
6 participants
@sberkovich @poiana @leogr @Kaizhe @Andreagit97 @mstemm