search

falcosecurity / falco

Cloud Native Runtime Security
https://falco.org
Apache License 2.0
7.13k stars 879 forks source link

Accessing Sensitives Files Under /etc/pam.d Via a Symlink Evades Detection With Default YAML Rules #2916

Closed agadient closed 21 hours ago

agadient commented 8 months ago

Describe the bug

Accessing a file under the /etc/pam.d directory via a symlink that doesn't include /etc/pam.d allows an attacker to evade detection by the standard ruleset.

How to reproduce it

Run the commands listed here: https://github.com/Vali-Cyber/ebpf-attacks/tree/main/symlink

Expected behaviour

The /etc/pam.d/cron file will be accessed without an alert being logged.

Environment

Linux hamden 5.15.0-87-generic #97-Ubuntu SMP Mon Oct 2 21:09:21 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

hamden@hamden:~$ cat /etc/os-release PRETTY_NAME="Ubuntu 22.04.1 LTS" NAME="Ubuntu" VERSION_ID="22.04" VERSION="22.04.1 LTS (Jammy Jellyfish)" VERSION_CODENAME=jammy ID=ubuntu ID_LIKE=debian HOME_URL="https://www.ubuntu.com/" SUPPORT_URL="https://help.ubuntu.com/" BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/" PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"

The container run command provided here: https://github.com/Vali-Cyber/ebpf-attacks/tree/main/agents

Additional context

Andreagit97 commented 8 months ago

Thank you for reporting, unfortunately, this is a known issue! we will try to solve it in the next releases

poiana commented 5 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

Andreagit97 commented 5 months ago

/remove-lifecycle stale

poiana commented 2 months ago

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana commented 1 month ago

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

poiana commented 21 hours ago

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community. /close

poiana commented 21 hours ago

@poiana: Closing this issue.

In response to [this](https://github.com/falcosecurity/falco/issues/2916#issuecomment-2250834038): >Rotten issues close after 30d of inactivity. > >Reopen the issue with `/reopen`. > >Mark the issue as fresh with `/remove-lifecycle rotten`. > >Provide feedback via https://github.com/falcosecurity/community. >/close Instructions for interacting with me using PR comments are available [here](https://git.k8s.io/community/contributors/guide/pull-requests.md). If you have questions or suggestions related to my behavior, please file an issue against the [kubernetes-sigs/prow](https://github.com/kubernetes-sigs/prow/issues/new?title=Prow%20issue:) repository.