Allow exe_running_docker_save in the "Create Hidden Files or Directories" and "Mkdir binary dirs" rules

[jhwbarlow]

What type of PR is this?

/kind bug

/kind rule-update

Any specific area of the project related to this PR?

/area rules

What this PR does / why we need it:

Adds exe_running_docker_save as an exception to the "Create Hidden Files or Directories" and "Mkdir binary dirs" rules, as these rules can be triggerred when a container is created. This brings these rules in line with similar rules which already contain this exception.

Does this PR introduce a user-facing change?:

Yes.

rules(Mkdir binary dirs): Adds exe_running_docker_save as an exception as this rules can be triggerred when a container is created.
rules(Create Hidden Files): Adds exe_running_docker_save as an exception as this rules can be triggerred when a container is created.

[poiana]

Welcome @jhwbarlow! It looks like this is your first PR to falcosecurity/falco 🎉

[jhwbarlow]

/assign @mstemm

[leodido]

/cc @Kaizhe

[Kaizhe]

@jhwbarlow , thank you for the PR. I need couple things from this PR, can you please provide more detail about:

1. Which docker version did you trigger rule?
2. What was the event look like ?

Thanks a lot!

Kaizhe

[jhwbarlow]

Hi @Kaizhe

uname -r; docker --version
4.19.140-flatcar
Docker version 18.06.3-ce, build d7080c1

The "Mkdir binary rules" can be triggered with a Dockerfile like so:

FROM alpine
RUN mkdir /usr/bin/james-was-here
CMD sleep 99d

Results in:

{"output":"15:28:21.995837530: Error Directory below known binary directory created (user=root command=exe /var/lib/docker/overlay2/437d9e72822e5e410d49407e7b5bde22caa2ebb5e5ff288143cd76da9ab6f0b6/diff directory=/usr/bin/james-was-here container_id=host image=<NA>) k8s.ns=<NA> k8s.pod=<NA> container=host k8s.ns=<NA> k8s.pod=<NA> container=host k8s.ns=<NA> k8s.pod=<NA> container=host k8s.ns=<NA> k8s.pod=<NA> container=host","priority":"Error","rule":"Mkdir binary dirs","time":"2020-09-04T15:28:21.995837530Z", "output_fields": {"container.id":"host","container.image.repository":null,"evt.arg.path":"/usr/bin/james-was-here","evt.time":1599233301995837530,"k8s.ns.name":null,"k8s.pod.name":null,"proc.cmdline":"exe /var/lib/docker/overlay2/437d9e72822e5e410d49407e7b5bde22caa2ebb5e5ff288143cd76da9ab6f0b6/diff","user.name":"root"}}

For the other rule, I wasn't able to provoke an alert as it is at NOTICE level, and we run our Falco only at ERROR, but it was changed for consistency with the other rules.

[poiana]

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

[jhwbarlow]

/remove-lifecycle stale

[leogr]

/cc @Kaizhe

[Kaizhe]

/lgtm

[poiana]

LGTM label has been added.

Git tree hash: 9fa199ad9e4a5300c67e126c9eaca6b47fa2db6f

[leogr]

/close

[poiana]

@leogr: Closed this PR.

In response to this:

/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[leogr]

/reopen

[poiana]

@leogr: Reopened this PR.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[poiana]

LGTM label has been added.

Git tree hash: 738b8c0309d722f92a65f61b48118d4b9b397dba

[poiana]

[APPROVALNOTIFIER] This PR is APPROVED

This pull-request has been approved by: fntlnz, Kaizhe, leodido, leogr

The full list of commands accepted by this bot can be found here.

The pull request process is described here

Needs approval from an approver in each of these files:

• rules/OWNERS [Kaizhe,fntlnz,leodido,leogr]

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[fntlnz]

Updated the release notes to follow our requirements for the release.