KubeArmor
KubeArmor copied to clipboard
bug(monitor): Kernelspace dropping of host logs doesn't work as intended
Bug Report
General Information
- Environment description: k3s (N/A)
- Kernel version (run
uname -a
):Linux kubearmor-dev-next 5.15.0-76-generic #83-Ubuntu SMP Thu Jun 15 19:16:32 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
- Orchestration system version in use (e.g.
kubectl version
, ...):v1.27.7+k3s2
- Link to relevant artifacts (policies, deployments scripts, ...)
- Target containers/pods
To Reproduce
- Add a debug log to see the telemetry event before this check: https://github.com/kubearmor/KubeArmor/blob/719ae8563da75f877966f7d2cd675ed9187f1100/KubeArmor/feeder/policyMatcher.go#L921-L922
Probably something like:
arr, _ := json.Marshal(log) fmt.Println(string(arr)) if visibility { (*log).Type = "HostLog" return true }
- Remove
hostVisibility
flag from KubeArmor's Makefile (as default is none) andmake run
- Checkout KubeArmor logs, you'll see misc. events happening on your host looking like:
{
"timestamp": 1701783232,
"updatedTime": "2023-12-05T13:33:52.937450Z",
"hostName": "",
"hostPPid": 1,
"hostPid": 1073,
"ppid": 0,
"pid": 1073,
"uid": 0,
"parentProcessName": "",
"processName": "",
"atags": null,
"type": "",
"source": "",
"operation": "Network",
"resource": "domain=AF_INET type=SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC protocol=0",
"cwd": "/var/lib/rancher/k3s/server/",
"oid": 0,
"data": "syscall=SYS_SOCKET",
"result": "Passed",
"policyEnabled": 1
}
Expected behavior
Host events should be dropped by the monitor itself based on configuration before they reach the feeder.
is this issue still relevant?I would like to work on this