KubeArmor icon indicating copy to clipboard operation
KubeArmor copied to clipboard

bug(monitor): Kernelspace dropping of host logs doesn't work as intended

Open DelusionalOptimist opened this issue 1 year ago • 1 comments

Bug Report

General Information

  • Environment description: k3s (N/A)
  • Kernel version (run uname -a): Linux kubearmor-dev-next 5.15.0-76-generic #83-Ubuntu SMP Thu Jun 15 19:16:32 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
  • Orchestration system version in use (e.g. kubectl version, ...): v1.27.7+k3s2
  • Link to relevant artifacts (policies, deployments scripts, ...)
  • Target containers/pods

To Reproduce

  1. Add a debug log to see the telemetry event before this check: https://github.com/kubearmor/KubeArmor/blob/719ae8563da75f877966f7d2cd675ed9187f1100/KubeArmor/feeder/policyMatcher.go#L921-L922 Probably something like:
    arr, _ := json.Marshal(log)
    fmt.Println(string(arr))
    if visibility {
    	(*log).Type = "HostLog"
    	return true
    }
    
    
  2. Remove hostVisibility flag from KubeArmor's Makefile (as default is none) and make run
  3. Checkout KubeArmor logs, you'll see misc. events happening on your host looking like:
{
  "timestamp": 1701783232,
  "updatedTime": "2023-12-05T13:33:52.937450Z",
  "hostName": "",
  "hostPPid": 1,
  "hostPid": 1073,
  "ppid": 0,
  "pid": 1073,
  "uid": 0,
  "parentProcessName": "",
  "processName": "",
  "atags": null,
  "type": "",
  "source": "",
  "operation": "Network",
  "resource": "domain=AF_INET type=SOCK_STREAM|SOCK_NONBLOCK|SOCK_CLOEXEC protocol=0",
  "cwd": "/var/lib/rancher/k3s/server/",
  "oid": 0,
  "data": "syscall=SYS_SOCKET",
  "result": "Passed",
  "policyEnabled": 1
}

Expected behavior

Host events should be dropped by the monitor itself based on configuration before they reach the feeder.

DelusionalOptimist avatar Dec 05 '23 13:12 DelusionalOptimist

is this issue still relevant?I would like to work on this

EraKin575 avatar Jun 02 '24 17:06 EraKin575