Add configuration value to run unprivileged with capabilities #305

bauerd · 2022-01-12T12:27:11Z

Signed-off-by: Dominic Bauer dbauer@gitlab.com

What type of PR is this?

/kind feature

Any specific area of the project related to this PR?

Uncomment one (or more) /area <> lines:

/area falco-chart

What this PR does / why we need it:

This PR introduces a leastPrivilege.enabled value that enables running Falco least privileged.

If enabled, the CAP_{BPF,SYS_RESOURCE,PERFMON} capabilities are assigned, and the containers run unprivileged.

Which issue(s) this PR fixes:

https://gitlab.com/gitlab-org/cluster-integration/cluster-applications/-/issues/51

Special notes for your reviewer:

The changelog does not have an entry for 1.16.3, yet Chart.yaml is at 1.16.3 currently. I bumped to 1.16.4 and added a changelog entry.

Checklist

Chart Version bumped
Variables are documented in the README.md
CHANGELOG.md updated

poiana · 2022-01-12T12:27:19Z

Welcome @bauerd! It looks like this is your first PR to falcosecurity/charts 🎉

leogr

Hey @bauerd

Thank you so much for this PR. We missed this feature for a long time 🙏

I haven't tried it yet, but after a quick look at your implementation, it SGTM. I just have a couple of questions.

Is the leastPrivileged option intended to be used in conjunction with the init container approach?
Or do we assume the user installed the driver by other means?
Basically, how can the driver be installed without privileged: true?
(it would be great to document that in the README)

I see you did not include SYS_PTRACE. It is included in our documentation, but I can't recall why it is needed. Could you explain why it's not needed in this case?

Same question for hostPid. I guess it is not needed since Falco can still access the host /proc?

bauerd · 2022-01-13T09:54:30Z

Hey @leogr, thanks for having a look, great questions.

Is the leastPrivileged option intended to be used in conjunction with the init container approach?

It depends on the driver. It won't work to load the kernel module unprivileged. But attaching the eBPF probe works with CAP_BPF and CAP_PERFMON.

So yes, good point, I should definitely note that leastPrivilege.enabled conflicts with loading the kernel module driver.

For the record, installting the chart from the master branch, the falco-driver-loader init script which should load the kernel module fails me on GKE on both COS 93 (5.10.68+) and COS 89 (5.4.144+). It attempts to wget a prebuilt kernel module that 404s (see logs). Unrelated to this PR though.

I see you did not include SYS_PTRACE. It is included in our documentation, but I can't recall why it is needed. Could you explain why it's not needed in this case?

My understanding is that only the pdig userspace driver uses ptrace(2). However pdig does not appear to be supported by this chart. Hence no need for CAP_SYS_PTRACE I think?

leogr · 2022-01-18T16:03:54Z

My understanding is that only the pdig userspace driver uses ptrace(2). However pdig does not appear to be supported by this chart. Hence no need for CAP_SYS_PTRACE I think?

Hey @bauerd

You're probably right. We have to find the time to confirm that before merging this PR.

PS
These days we are a bit busy because of the upcoming release. Sorry for the wait in advance.

bauerd · 2022-01-18T16:41:57Z

Hi, don't worry and take your time 👍 For the record, I also tested this on GKE.

FedeDP · 2022-02-01T14:50:18Z

falco/templates/daemonset.yaml

+            {{- if .Values.leastPrivileged.enabled }}
+            capabilities:
+              add:
+              - BPF


Note that this requires runc 1.0.0-rc93 onwards: https://github.com/opencontainers/runc/pull/2553/files.
In older versions, this won't work.

leogr

quick update:

I believe this can work only with ebpf (see my suggestion below)
There's a conflict; the PR needs a rebase

cc @bauerd
I'm still testing this PR. Once done, I can fix the comment and do the rebase by myself (so no action is required by you). Then, I'll give my final approval :)

falco/values.yaml

FedeDP · 2022-02-08T10:32:56Z

Hi @bauerd !
I tried on GKE 1.21.6-gke.1500 with kernel 5.10.90+; your chart leads to

eBPF probe located in /root/.falco/falco_cos_5.4.144+_1.o

Success: eBPF probe symlinked to /root/.falco/falco-bpf.o
Tue Feb 8 10:00:50 2022: Falco version 0.30.0 (driver version 3aa7a83bf7b9e6229a3824e3fd1f4452d1e95cb4)
Tue Feb 8 10:00:50 2022: Falco initialized with configuration file /etc/falco/falco.yaml
Tue Feb 8 10:00:50 2022: Loading rules from file /etc/falco/falco_rules.yaml:
Tue Feb 8 10:00:51 2022: Loading rules from file /etc/falco/falco_rules.local.yaml:
Tue Feb 8 10:00:51 2022: Loading rules from file /etc/falco/falco_rules.local.yaml:
Tue Feb 8 10:00:51 2022: Unable to load the driver.
Tue Feb 8 10:00:51 2022: Runtime error: can't create map: Errno 1. Exiting.
Tue Feb 8 10:00:51 2022: Unable to load the driver.
Tue Feb 8 10:00:51 2022: Runtime error: can't create map: Errno 1. Exiting.

I tried adding CAP_TRACING (as suggested here) and CAP_PTRACE. Still same error.

In the end, i tried with CAP_SYS_ADMIN too (just to check that everything was working fine), and obviously it worked.

Any hint?

EDIT: looking around, i found this issue: falcosecurity/falco#1299

EDIT2: it seems like i was using a 5.4 kernel after all (uname was run on the "master" machine instead of real nodes); these tests make no sense :)

EDIT3: tested on latest GKE version available (1.23.2) where nodes use kernel 5.10.68+.
Everything works fine, as expected!

paulopontesm · 2022-02-21T15:26:08Z

Can this be merged? Is there something missing?

leogr · 2022-02-22T09:48:43Z

Quick update:

We have done some investigation and testing. In the end, we discovered that:

this approach can currently work only with eBPF and kernel >= 5.8
it also requires runc >= 1.0.0-rc93 (otherwise some capabilities won't work)
CAP_PTRACE is required (even if Falco does not use ptrace) when using --pid=host (it allows to read from processes environ). That was needed only when HOST_ROOT=/, but it's not the case for the helm chart.

So, I will rebase this PR soon and likely give my approval.

I will keep you posted.

Signed-off-by: Dominic Bauer <dbauer@gitlab.com>

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

leogr

/approve

Note:
I've rebased the PR and resolved some conflicts.
Also added a commit to clarify this option can only work with ebpf.

poiana · 2022-02-22T15:11:15Z

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: bauerd, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

~~falco/OWNERS~~ [leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

poiana · 2022-02-22T15:11:15Z

LGTM label has been added.

Git tree hash: 88d4b866611df5af9665c051f6629c96964611c4

poiana added kind/feature New feature or request dco-signoff: yes area/falco-chart labels Jan 12, 2022

poiana requested review from bencer and nestorsalceda January 12, 2022 12:27

poiana added the size/L label Jan 12, 2022

leogr reviewed Jan 13, 2022

View reviewed changes

poiana added dco-signoff: no and removed dco-signoff: yes labels Jan 13, 2022

bauerd force-pushed the least-privileged branch from 5b289ad to 83c7264 Compare January 13, 2022 10:01

poiana added dco-signoff: yes and removed dco-signoff: no labels Jan 13, 2022

FedeDP reviewed Feb 1, 2022

View reviewed changes

leogr reviewed Feb 1, 2022

View reviewed changes

falco/values.yaml Outdated Show resolved Hide resolved

Dominic Bauer and others added 4 commits February 22, 2022 15:54

Introduce leastPrivilege.enabled value to enable capabilities

46056b9

Signed-off-by: Dominic Bauer <dbauer@gitlab.com>

Bump to v1.16.4

4e2024f

Signed-off-by: Dominic Bauer <dbauer@gitlab.com>

Note that kernel module cannot be loaded when unprivileged

826f426

Signed-off-by: Dominic Bauer <dbauer@gitlab.com>

docs(falco): leastPrivileged works with eBPF only

6a9bf88

Signed-off-by: Leonardo Grasso <me@leonardograsso.com>

leogr force-pushed the least-privileged branch from 83c7264 to 6a9bf88 Compare February 22, 2022 15:01

leogr approved these changes Feb 22, 2022

View reviewed changes

poiana assigned leogr Feb 22, 2022

poiana added the lgtm label Feb 22, 2022

poiana added the approved label Feb 22, 2022

poiana merged commit 11c83ac into falcosecurity:master Feb 22, 2022

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Add configuration value to run unprivileged with capabilities #305

Add configuration value to run unprivileged with capabilities #305

bauerd commented Jan 12, 2022

poiana commented Jan 12, 2022

leogr left a comment

bauerd commented Jan 13, 2022 •

edited

Loading

leogr commented Jan 18, 2022

bauerd commented Jan 18, 2022

FedeDP Feb 1, 2022

leogr left a comment

FedeDP commented Feb 8, 2022 •

edited

Loading

paulopontesm commented Feb 21, 2022

leogr commented Feb 22, 2022

leogr left a comment

poiana commented Feb 22, 2022

poiana commented Feb 22, 2022

Add configuration value to run unprivileged with capabilities #305

Add configuration value to run unprivileged with capabilities #305

Conversation

bauerd commented Jan 12, 2022

poiana commented Jan 12, 2022

leogr left a comment

Choose a reason for hiding this comment

bauerd commented Jan 13, 2022 • edited Loading

leogr commented Jan 18, 2022

bauerd commented Jan 18, 2022

FedeDP Feb 1, 2022

Choose a reason for hiding this comment

leogr left a comment

Choose a reason for hiding this comment

FedeDP commented Feb 8, 2022 • edited Loading

paulopontesm commented Feb 21, 2022

leogr commented Feb 22, 2022

leogr left a comment

Choose a reason for hiding this comment

poiana commented Feb 22, 2022

poiana commented Feb 22, 2022

bauerd commented Jan 13, 2022 •

edited

Loading

FedeDP commented Feb 8, 2022 •

edited

Loading