falco
falco copied to clipboard
falcosecurity
Replace --privileged flag with explicit set of capabilities
It would be nice if we replaced the --privileged flag with a (smaller) list of capabilities. On our slack channel, Maksym Budonnyy mentioned that he was able to get falco to run properly with these capabilities:
Hi All,
After series of tries, I was able to run Falco in the non-privileged container.
Limitations: I tried only eBPF Falco
set of capabilities:
CAP_SYS_ADMIN - required for the bpf syscall
CAP_SYS_RESOURCE - required to change rlimit
CAP_SYS_NICE
CAP_SYS_PTRACE - to provide correct access to the /proc for scap_proc_scan_proc_dir??
CAP_FOWNER
CAP_SYS_PACCT
We should double-check and if these work, update our docs and recommended k8s config to use these enumerated capabilities instead.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
![stale[bot] avatar](https://avatars.githubusercontent.com/in/1724?v=4 "Published by a pub.dev verified publisher"){kind=small}
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
We still want this
On Fri, 7 Feb 2020 at 13:51, stale[bot] [email protected] wrote:
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/falcosecurity/falco/issues/628?email_source=notifications&email_token=AAA5J454OZ4REAT4ZK4JYALRBVKNDA5CNFSM4HQHXKK2YY3PNVWWK3TUL52HS4DFVREXG43VMVBW63LNMVXHJKTDN5WW2ZLOORPWSZGOELCZ6IQ#issuecomment-583376674, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA5J43KRKYML7FCWHBC2PDRBVKNDANCNFSM4HQHXKKQ .
-- L.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
Keeep L.
On Tue, Apr 7, 2020 at 6:29 PM stale[bot] [email protected] wrote:
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/falcosecurity/falco/issues/628#issuecomment-610488887, or unsubscribe https://github.com/notifications/unsubscribe-auth/AAA5J4674Y6X34KXADEJQXDRLNIFNANCNFSM4HQHXKKQ .
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions.
This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs. Thank you for your contributions. Issues labeled "cncf", "roadmap" and "help wanted" will not be automatically closed. Please refer to a maintainer to get such label added if you think this should be kept open.
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
Stale issues rot after 30d of inactivity.
Mark the issue as fresh with /remove-lifecycle rotten.
Rotten issues close after an additional 30d of inactivity.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle rotten
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Provide feedback via https://github.com/falcosecurity/community. /close
@poiana: Closing this issue.
In response to this:
Rotten issues close after 30d of inactivity.
Reopen the issue with
/reopen.Mark the issue as fresh with
/remove-lifecycle rotten.Provide feedback via https://github.com/falcosecurity/community. /close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
Hey @leodido, any updates or roadmap plan on this? It seems all related issues are closed due to 30d inactivity. We are running our Falco pods with securityContext: privileged: true, but we prefer to use explicit set of capabilities instead of pass privileged: true for the container.
Version: 0.26.2
cc: @developer-guy
/reopen
Hey @Dentrax
AFAIK, we currently support that only for the "least privileged" approach, but it comes with some caveats :point_down: https://falco.org/docs/getting-started/running/#docker-least-privileged
@leogr: Reopened this issue.
In response to this:
/reopen
Hey @Dentrax
AFAIK, we currently support that only for the "least privileged" approach, but it comes with some caveats :point_down: https://falco.org/docs/getting-started/running/#docker-least-privileged
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Provide feedback via https://github.com/falcosecurity/community. /close
@poiana: Closing this issue.
In response to this:
Rotten issues close after 30d of inactivity.
Reopen the issue with
/reopen.Mark the issue as fresh with
/remove-lifecycle rotten.Provide feedback via https://github.com/falcosecurity/community. /close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
@jasondellaluce: Reopened this issue.
In response to this:
/reopen
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
Rotten issues close after 30d of inactivity.
Reopen the issue with /reopen.
Mark the issue as fresh with /remove-lifecycle rotten.
Provide feedback via https://github.com/falcosecurity/community. /close
@poiana: Closing this issue.
In response to this:
Rotten issues close after 30d of inactivity.
Reopen the issue with
/reopen.Mark the issue as fresh with
/remove-lifecycle rotten.Provide feedback via https://github.com/falcosecurity/community. /close
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
@jasondellaluce: Reopened this issue.
In response to this:
/reopen
/remove-lifecycle rotten
Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.
Hi @leogr, I wasn't aware of this issue, but yes, I have identified the needed capabilities when using eBPF driver. I have already a PR that got merged recently into the website, and you can find it here. Take a look at it if you're interested, I have tried to explain why each capability is actually needed!
Issues go stale after 90d of inactivity.
Mark the issue as fresh with /remove-lifecycle stale.
Stale issues rot after an additional 30d of inactivity and eventually close.
If this issue is safe to close now please do so with /close.
Provide feedback via https://github.com/falcosecurity/community.
/lifecycle stale
I still think this is something we have to improve for
/milestone 1.0.0
so
/remove-lifecycle stale