search

kubearmor / KubeArmor

Runtime Security Enforcement System. Workload hardening/sandboxing and implementing least-permissive policies made easy leveraging LSMs (BPF-LSM, AppArmor).
https://kubearmor.io/
Apache License 2.0
1.46k stars 338 forks source link

Host policy Matchpatterns logs #552

Open bestgaurav opened 2 years ago

bestgaurav commented 2 years ago

Bug Report

General Information

To Reproduce

  1. Make a Kubearmor host policy with matchpatterns
  2. apply that policy
  3. execute that node to test policy
  4. In another terminal check for kubearmor logs
  5. All commands will block as expected as we applied the policy before but in another terminal logs will not come

Expected behavior

After applying the policy logs should come for the command that is blocked.

Screenshots

image image image

h3llix commented 2 years ago

I don't think it's a bug, Can you elaborate more on this issue?. It is working fine in my case.

Have you tried forwarding port from kubectl ? kubectl port-forward -n kube-system svc/kubearmor 32767:32767 cc @nyrahul @nam-jaehyun

nyrahul commented 2 years ago

This seems to be a bug.

If I apply following policy:

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: autopol-system-4153385364
  namespace: explorer
spec:
  severity: 1
  selector:
    matchLabels:
      container: knoxautopolicy
  process:
    matchPaths:
    - path: /**/chmod
  action: Block

The policy is enforced and the execution of chmod is blocked. However, the alerts are not sent.

If I simply change the - path: /**/chmod to - path: /usr/bin/chmod, the alerts work as expected. Hence confirming this as an issue.

anu491 commented 2 years ago

I would like to work on this issue , being somewhat new to the library, could someone guide me through the file structure or rather the file which I should be looking into for a possible fix ? @nyrahul

slayer321 commented 2 years ago

Hey @nyrahul, I applied your above policy. It is getting blocked and I'm also getting the alerts. Is this issue fixed ? or the issue is with KubeArmorHostPolicy and not the KubeArmorPolicy

nyrahul commented 2 years ago

Hey @nyrahul, I applied your above policy. It is getting blocked and I'm also getting the alerts. Is this issue fixed ? or the issue is with KubeArmorHostPolicy and not the KubeArmorPolicy

I havent tried. However, there were some fixes made in the context. Not sure if it fixed it. Can you try karmor install --image kubearmor/kubearmor:v0.3 and check if the same scenario works with this image? It should not.

slayer321 commented 2 years ago

yes, I tried installing v0.3 version and can confirm that it is not working. By kubearmor/kubearmor:stable we mean the latest release version of KubeArmor right?

nyrahul commented 1 year ago

It would be difficult to support policy matching with rules having regex, globbing patterns. This is especially difficult to handle with BPF-LSM based enforcer since matching based on globbing patterns using constrained ebpf instruction set is not possible. We will have to redefine the problem statement.

I would suggest making the change in the spec to something like this:

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: autopol-system-4153385364
  namespace: explorer
spec:
  severity: 1
  selector:
    matchLabels:
      container: knoxautopolicy
  process:
    matchPaths:
    - endswith: /chmod     # Block all bins ending with /chmod
    - startswith: /bin/    # Block all bins in the /bin dir
    - contains: chmod      # Block all bins containing chmod in their full path
  action: Block