2024-02-12

[araujof]

Participants

• Luca Muscariello
• Mauro Sardara
• Andreas Genuise
• Teryl Taylor
• Fred Araujo
• Oleksandr (Alex) Zolotko

Discussion

• [@luca] Collector: Working on reproducible builds that can be deployed outside the SysFlow organization (locally, e.g., using act) [WIP]
• [@mauro] Processor: Have a black box tester for Falco and SysFlow for rule sets [WIP]
  • Need to include thread.cap_permitted to spec
• [@araujof] Collector: changing build to dynamically link to libelf [WIP]
• [@terylt] Libs0.14 takes the k8s metadata collector out as a libs plugin
  • Need to support the plugin module in the collector
  • Removing FALCO_DRIVER_LOADER

[msardara]

Examples of Falco macros not currently supported by sysflow:

- macro: excessively_capable_container
   condition: >
     (thread.cap_permitted contains CAP_SYS_ADMIN
     or thread.cap_permitted contains CAP_SYS_MODULE
     or thread.cap_permitted contains CAP_SYS_RAWIO
     or thread.cap_permitted contains CAP_SYS_PTRACE
     or thread.cap_permitted contains CAP_SYS_BOOT
     or thread.cap_permitted contains CAP_SYSLOG
     or thread.cap_permitted contains CAP_DAC_READ_SEARCH
     or thread.cap_permitted contains CAP_NET_ADMIN
     or thread.cap_permitted contains CAP_BPF)

Example of spec not supported by sysflow

thread.cap_permitted
thread.cap_effective icontains sys_module
evt.arg.mode contains "S_IXUSR"
evt.arg.mode contains "S_IXGRP"
evt.arg.mode contains "S_IXOTH"

evt.type = ptrace
evt.type = userfaultfd
fd.sip.name

If you show me how to add something in sysflow specs starting from falco libs I can redo the process for adding new attributes in the future:)

[araujof]

Sounds great! We are just finishing up the changes we made to support the dynamic linking of libelf. We play to cut a 0.6.1-rc2 by tomorrow. Let's work on these missing fields next week :)

[araujof]

PR for updating the build pipelines (musl and glibc) to shared libelf.
sysflow-telemetry/sf-collector#64 (cc: @terylt )

[araujof]

0.6.1-rc2 pre-release: https://github.com/sysflow-telemetry/sf-collector/releases/tag/0.6.1-rc2-skip-tests