Docker安全入门与实战（三）

sudo -s
mkdir/etc/falco
cd/etc/falco
curl https://raw.githubusercontent.com/katacoda-scenarios/sysdig-scenarios/master/sysdig-falco/assets/falco.yaml -o falco.yaml

$ cat falco.yaml
#中间大部分省略了，主要是展示和输出相关的配置
# Where security notifications should go.
# Multiple outputs can be enabled.

syslog_output:
  enabled: false

file_output:
  enabled: true
  filename: /var/log/falco_events.log

stdout_output:
  enabled: true

program_output:
  enabled: false
  program: mail -s "Falco Notification" someone@example.com

curl ttps://raw.githubusercontent.com/katacoda-scenarios/sysdig-scenarios/master/sysdig-falco/assets/falco_rules.yaml -o falco_rules.yaml

$ cat falco_rules.yaml
#中间大部分省略了，主要是检测规则的配置
- rule: Read sensitive file untrusted
  desc: >
    an attempt to read any sensitive file (e.g. files containing user/password/authentication
    information). Exceptions are made for known trusted programs.
  condition: >
    sensitive_files and open_read
    and not proc.name in (user_mgmt_binaries, userexec_binaries, package_mgmt_binaries,
     cron_binaries, read_sensitive_file_binaries, shell_binaries, hids_binaries)
    and not cmp_cp_by_passwd
    and not ansible_running_python
    and not proc.cmdline contains /usr/bin/mandb
  output: >
    Sensitive file opened for reading by non-trusted program (user=%user.name name=%proc.name
    command=%proc.cmdline file=%fd.name)
  priority: WARNING
  tags: [filesystem]

docker pull sysdig/falco
docker run -d --name falco --privileged -v /var/run/docker.sock:/host/var/run/docker.sock -v/dev:/host/dev -v/proc:/host/proc :ro -v/boot:/host/boot:ro -v/lib/modules:/host/lib/modules:ro -v/usr:/host/usr:ro -v /etc/falco/falco.yaml: /etc/falco/falco.yaml -v /etc/falco/falco_rules.yaml:/etc/falco/falco_rules.yaml -v /var/log/falco_events.log:/var/log/falco_events.log sysdig/falco

$ docker ps
CONTAINER ID        IMAGE               COMMAND                  CREATED             STATUSPORTS               NAMES
81cf560cb4d0        sysdig/falco        "/docker-entrypoint.…"   59 seconds ago      Up 25 seconds                    falco

docker run -d -P --name example1 nginx
docker ps

17:13:24.357351845: Notice A shell was spawned in a container with an attached terminal (user=root example1 (id=604aa46610dd) shell=bash parent=<NA> cmdline=bash terminal=34816)

- rule: Terminal shell in container
   desc: A shell was spawned by a program in a container with an attached terminal.
   condition: >
     spawned_process and container
     and shell_procs and proc.tty != 0
   output: "A shell was spawned in a container with an attached terminal (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline terminal=%proc.tty)"
   priority: NOTICE
   tags: [container, shell]

sudo -s
cd/etc/falco
curl https://raw.githubusercontent.com/katacoda-scenarios/sysdig-scenarios/master/sysdig-falco/assets/falco_rules_step3.yaml -o falco_rules.yaml

# Our nginx containers should only be running the 'nginx' process
 - rule: Unauthorized process on nginx containers
   desc: There is a process running in the nginx container that is not described in the template
   condition: spawned_process and container and container.image startswith nginx and not proc.name in (nginx)
   output: Unauthorized process (%proc.cmdline) running in (%container.id)
   priority: WARNING

$ docker exec -it example2 ls
bin   dev  home  lib64  mnt  proc  run   srv  tmp  var
boot  etc  lib   media  opt  root  sbin  sys  usr

$ tail /var/log/falco_events.log
17:16:00.345074348: Notice A shell was spawned in a container with an attached terminal (user=root example1 (id=083bf0190f7e) shell=bash parent=<NA> cmdline=bash  terminal=34816)
17:16:54.625502123: Warning Unauthorized process (ls ) running in (d81ccf05e0a6)

sudo -s
cd/etc/falco
curl https://raw.githubusercontent.com/katacoda-scenarios/sysdig-scenarios/master/sysdig-falco/assets/falco_rules_step4.yaml -o falco_rules.yaml

- rule: Write to non user_data dir
   desc: attempt to write to directories that should be immutable
   condition: open_write and container and not user_data_dir
   output: "Writing to non user_data dir (user=%user.name command=%proc.cmdline file=%fd.name)"
   priority: ERROR

- macro: open_write
 condition: (evt.type=open or evt.type=openat) and evt.is_open_write=true and fd.typechar='f'

docker run -d -P --name example3 nginx
docker exec -it example3 bash
mkdir /userdata
touch /userdata/foo
touch /usr/foo

$ tail /var/log/falco_events.log
...
17:19:23.529937252: Error Writing to non user_data dir (user=root command=bash  file=/dev/tty)
17:19:23.540872232: Error Writing to non user_data dir (user=root command=touch /usr/foo file=/usr/foo)

sudo -s
cd/etc/falco
curl https://raw.githubusercontent.com/katacoda-scenarios/sysdig-scenarios/master/sysdig-falco/assets/falco_rules_step5.yaml -o falco_rules.yaml

- rule: Launch Sensitive Mount Container
desc: >
  Detect the initial process started by a container that has a mount from a sensitive host directory
  (i.e. /proc). Exceptions are made for known trusted images.
condition: evt.type=execve and proc.vpid=1 and container and sensitive_mount and not trusted_containers
output: Container with sensitive mount started (user=%user.name command=%proc.cmdline %container.info)
priority: INFO
tags: [container, cis]

- macro: sensitive_mount
condition: (container.mount.dest[/proc*] != "N/A" or container.mount.dest[/mnt*] != "N/A")

docker run -d -P --name example4 -v/mnt:/tmp/mnt alpine

17:21:07.360913099: Informational Container with sensitive mount started (user=root command=sh  example4(id=c35126bf862a))

docker pull sysdig/falco-event-generator
docker run -d --name falco-event-generator sysdig/falco-event-generator

19:00:55.362191761: Error File created below /dev by untrusted program (user=root command=event_generator  file=/dev/created-by-event-generator-sh)
19:00:56.365043165: Notice Database-related program spawned process other than itself (user=root program=sh -c ls > /dev/null parent=mysqld)
19:00:57.367928872: Warning Sensitive file opened for reading by non-trusted program (user=root name=event_generator command=event_generator  file=/etc/shadow)
19:00:59.370589147: Error File below known binary directory renamed/removed (user=root command=event_generator  operation=rename file=<NA> res=0 oldpath=/bin/true newpath=/bin/true.event-generator-sh )
...