fix!: get_user_falco_rules now returns the text and is updated with the new API endpoint (#151)

* fix: Custom rules are now correctly set and retrieved as string

* style: Change imports with concrete types

* fix: Update get_secure_user_falco_rules example to match the changes

* fix: Remove old outdated test

Author: tembleking

examples/get_secure_user_falco_rules.py

@@ -31,7 +31,7 @@
 # Return the result
 #
 if ok:
-    sys.stdout.write(res["userRulesFile"]["content"])
+    sys.stdout.write(res)
 else:
     print(res)
     sys.exit(1)

fixtures/custom_rules.yaml

@@ -0,0 +1,375 @@
+####################
+# Your custom rules!
+####################
+
+# Add new rules, like this one
+# - rule: A shell is run in a container
+#   desc: An event will trigger every time you run a shell in a container
+#   condition: evt.type = execve and evt.dir=< and container.id != host and proc.name = bash
+#   output: "Suspect shell run in container (user=%user.name %container.info shell=%proc.name parent=%proc.pname cmdline=%proc.cmdline)"
+#   priority: ERROR
+#   tags: [shell]
+
+# Or override any rule, macro, or list from the Default Rules
+---
+- macro: "user_known_k8s_client_container"
+  condition: "container.image.repository=\"k8s.gcr.io/fluentd-gcp-scaler\" or container.image.repository=\"\
+    fluxcd/flux\" or container.image.repository=\"sysdig/agent\" or container.image.repository=\"\
+    fluxcd/helm-operator\" or (container.image.repository=\"google/cloud-sdk\")"
+  append: false
+
+- macro: "user_known_write_below_root_activities"
+  condition: "(container.image.repository startswith \"bbcdocker/go-synapse\" and\
+    \ fd.name=\"/haproxy.conf\") or (container.image.repository=\"cassandra\" and\
+    \ fd.name startswith \"/root/.cassandra/\") or (container.id=host and fd.name\
+    \ startswith /root/.kube/) or (container.image.repository=\"mariadb\" and proc.name=\"\
+    mysqld\") or (container.image.repository=\"mariadb\" and proc.name=\"mysql\")"
+  append: false
+
+- macro: "user_known_network_tool_client_container"
+  condition: "container.image.repository=\"bbcdocker/go-synapse\" or container.image.repository=\"\
+    strimzi/kafka\" or container.image.repository=\"landoop/fast-data-dev\""
+  append: false
+
+- rule: "Launch Suspicious Network Tool in Container"
+  condition: "and not user_known_network_tool_client_container"
+  tags: []
+  append: true
+
+- rule: "Java app run shell untrusted"
+  desc: "an attempt to spawn a shell below a Java application."
+  condition: "spawned_process and shell_procs and proc.pname exists and proc.pname=java\n"
+  output: "Shell spawned by Java application (user=%user.name shell=%proc.name parent=%proc.pname\
+    \ cmdline=%proc.cmdline pcmdline=%proc.pcmdline gparent=%proc.aname[2] ggparent=%proc.aname[3]\
+    \ aname[4]=%proc.aname[4] aname[5]=%proc.aname[5] aname[6]=%proc.aname[6] aname[7]=%proc.aname[7]\
+    \ container_id=%container.id image=%container.image.repository)\n"
+  priority: "ALERT"
+  tags:
+  - "shell"
+  - "mitre_execution"
+  source: "syscall"
+  append: false
+
+- macro: "user_known_write_below_etc_activities"
+  condition: "(container.image.repository=\"quay.io/thanos/thanos\" and fd.name=\"\
+    /etc/prom/prometheus.yaml.tmp\" or (container.image.repository=\"eu.gcr.io/bbc-registry/comuto3\"\
+    \ and fd.name startswith \"/etc/nginx/\"))"
+  append: false
+
+- rule: "The docker client is executed in a container"
+  desc: "Detect a k8s client tool executed inside a container"
+  condition: "spawned_process and container and not user_known_k8s_client_container\
+    \ and proc.name in (k8s_client_binaries)"
+  output: "Docker or kubernetes client executed in container (user=%user.name %container.info\
+    \ parent=%proc.pname cmdline=%proc.cmdline image=%container.image.repository:%container.image.tag\
+    \ podname=%k8s.pod.name)"
+  priority: "WARNING"
+  tags:
+  - "container"
+  - "mitre_execution"
+  append: false
+
+- macro: "user_read_sensitive_file_conditions"
+  condition: "or container.image.repository=\"sysdig/agent\" or (container.id=host\
+    \ and fd.name=/etc/pam.d/sshd and proc.name=grep)"
+  append: true
+
+- rule: "Root user interactive"
+  desc: "an attempt to run interactive commands by root user"
+  condition: "spawned_process and user.name=\"root\" and interactive"
+  output: "Root user ran an interactive command (user=%user.name command=%proc.cmdline\
+    \ container_id=%container.id image=%container.image.repository)"
+  priority: "INFO"
+  tags:
+  - "mitre_remote_access_tools"
+  - "users"
+  append: false
+
+- macro: "user_known_write_etc_conditions"
+  condition: "proc.name=confd or (container.image.repository=\"confluentinc/cp-schema-registry\"\
+    \ and fd.name startswith \"/etc/schema-registry/\") or (container.image.repository=\"\
+    eu.gcr.io/bbc-registry/communication\" and fd.name startswith \"/etc/nginx/\"\
+    ) or (container.image.repository=\"eu.gcr.io/bbc-registry/redirector\" and fd.name\
+    \ startswith \"/etc/nginx/\") or (container.image.repository=\"eu.gcr.io/bbc-registry/webhooks\"\
+    \ and fd.name startswith \"/etc/nginx/\")or (container.image.repository=\"thanosio/thanos\"\
+    \ and fd.name startswith \"/etc/prom/\") or (container.image.repository=\"eu.gcr.io/bbc-registry/insurance-backoffice\"\
+    \ and fd.name startswith \"/etc/nginx/\") or (container.id=\"host\" and proc.name=\"\
+    exe\" and proc.pname=\"dockerd\")"
+  append: false
+
+- macro: "user_known_package_manager_in_container"
+  condition: "(container.image.repository=\"confluentinc/cp-schema-registry\" and\
+    \ proc.name=\"pip\") or (container.image.repository=sysdig/node-image-analyzer\
+    \ and proc.name=rpm)"
+  append: false
+
+- macro: "user_privileged_containers"
+  condition: "(container.image.repository endswith sysdig/agent) or (container.image.repository=weaveworks/scope)\
+    \ or (container.image.repository=docker.io/weaveworks/scope) or (container.image.repository=gcr.io/google-containers/startup-script)\
+    \ or (container.image.repository=gke.gcr.io/kube-proxy) or (container.image.repository=sysdig/node-image-analyzer)"
+  append: false
+
+- macro: "user_sensitive_mount_containers"
+  condition: "(container.image.repository = docker.io/sysdig/agent) or (container.image.repository=quay.io/prometheus/node-exporter)\
+    \ or (container.image.repository=weaveworks/scope) or (container.image.repository=datadog/agent)"
+  append: false
+
+- macro: "user_known_change_thread_namespace_activities"
+  condition: "container.image.repository=gcr.io/google-containers/startup-script"
+  append: false
+
+- list: "user_known_hostnetwork_images"
+  items:
+  - "gke.gcr.io/kube-proxy"
+  - "gke.gcr.io/kube-proxy-amd64"
+  - "newrelic/infrastructure-k8s"
+  - "k8s.gcr.io/prometheus-to-sd"
+  - "docker.io/sysdig/agent"
+  - "gcr.io/stackdriver-agents/stackdriver-logging-agent"
+  - "newrelic/newrelic-fluentbit-output"
+  - "gcr.io/gke-release/gke-metrics-agent"
+  - "quay.io/prometheus/node-exporter"
+  append: false
+
+- rule: "Create HostNetwork Pod"
+  condition: "and not ka.req.pod.containers.image.repository intersects (user_known_hostnetwork_images)"
+  output: "Pod started using host network (user=%ka.user.name pod=%ka.resp.name ns=%ka.target.namespace\
+    \ images=%ka.req.pod.containers.repository)"
+  tags: []
+  append: true
+
+- list: "user_known_privileged_images"
+  items:
+  - "gcr.io/google-containers/startup-script"
+  - "gke.gcr.io/kube-proxy-amd64"
+  - "newrelic/infrastructure-k8s"
+  - "docker.io/sysdig/node-image-analyzer"
+  append: false
+
+- rule: "Create Privileged Pod"
+  condition: "and not ka.req.pod.containers.image.repository in (user_known_privileged_images)"
+  tags: []
+  append: true
+
+- list: "user_known_kube_namespace_images"
+  items:
+  - "gcr.io/google-containers/startup-script"
+  - "gke.gcr.io/kube-proxy-amd64"
+  - "k8s.gcr.io/gke-node-termination-handler"
+  - "gcr.io/gke-release/gke-metrics-agent"
+  - "k8s.gcr.io/k8s-dns-kube-dns-amd64"
+  - "k8s.gcr.io/prometheus-to-sd"
+  - "gke.gcr.io/k8s-dns-dnsmasq-nanny-amd64"
+  - "gke.gcr.io/k8s-dns-sidecar-amd64"
+  append: false
+
+- rule: "Pod Created in Kube Namespace"
+  condition: "and not ka.req.container.image.repository in (user_known_kube_namespace_images)"
+  tags: []
+  append: true
+
+- macro: "user_shell_container_exclusions"
+  condition: "((container.image.repository=bitnami/rabbitmq and proc.pname=erl) or\
+    \ (container.image.repository=bitnami/rabbitmq and proc.pname=\"beam.smp\"))"
+  append: false
+
+- macro: "user_known_write_root_conditions"
+  condition: "(fd.name=/root/.bash_history) or (container.image.repository=\"cassandra\"\
+    \ and fd.name startswith \"/root/.cassandra/\") or (container.image.repository=\"\
+    bbcdocker/go-synapse\" and fd.name=\"/haproxy.conf\") or (container.id=\"host\"\
+    \ and proc.name=\"exe\" and proc.pname=\"dockerd\")"
+  append: false
+
+- macro: "exe_running_docker_save"
+  condition: "((proc.cmdline startswith \"exe /var/lib/docker\" or proc.cmdline startswith\
+    \ \"exe / /var/lib/docker\") and proc.pname in (dockerd, docker))"
+  append: false
+
+- rule: "Update Package Repository"
+  condition: "and not exe_running_docker_save"
+  tags: []
+  append: true
+
+- rule: "Modify Shell Configuration File"
+  condition: "and not exe_running_docker_save"
+  tags: []
+  append: true
+
+- rule: "Change thread namespace"
+  condition: "and not (container.image.repository=\"datadog/agent\" and proc.name=\"\
+    system-probe\")"
+  tags: []
+  append: true
+
+- macro: "allowed_clear_log_files"
+  condition: "(container.image.repository=\"landoop/fast-data-dev\" and fd.name=\"\
+    /var/log/broker.log\")"
+  append: false
+
+- list: "user_known_gke_metadata_images"
+  items:
+  - "gke.gcr.io/kube-proxy-amd64"
+  - "gcr.io/gke-release/gke-metrics-agent"
+  - "gke.gcr.io/k8s-dns-kube-dns-amd64"
+  - "k8s.gcr.io/prometheus-to-sd"
+  - "newrelic/infrastructure-k8s"
+  - "datadog/agent"
+  - "gke.gcr.io/prometheus-to-sd"
+  - "sysdig/agent"
+  - "gcr.io/stackdriver-agents/stackdriver-logging-agent"
+  - "gcr.io/stackdriver-agents/metadata-agent-go"
+  - "istio/proxyv2"
+  - "newrelic/k8s-events-forwarder"
+  - "gke.gcr.io/calico/typha"
+  append: false
+
+- macro: "mariadb_snapshots_validator"
+  condition: "(container.image.repository=\"google/cloud-sdk\" and container.name\
+    \ contains\"snapshot-validator\")"
+  append: false
+
+- macro: "bbc_java_app_proc"
+  condition: "(container.image.repository startswith \"eu.gcr.io/bbc-registry/\" and\
+    \ proc.name=\"java\")"
+  append: false
+
+- macro: "gke_metadata_containers"
+  condition: "(container.image.repository in (user_known_gke_metadata_images)) or\
+    \ mariadb_snapshots_validator or proc.name=\"newrelic-daemon\" or (container.image.repository=\"\
+    docker.elastic.co/beats/filebeat\" and proc.name=\"filebeat\")"
+  append: false
+
+- rule: "Contact GKE Instance Metadata Service From Container"
+  desc: "Detect attempts to contact the GKE Instance Metadata Service from a container"
+  condition: "outbound and fd.sip=\"169.254.169.254\" and container and not gke_metadata_containers"
+  output: "Outbound connection to GKE instance metadata service (proc=%proc.name procp=%proc.pname\
+    \ procpp=%proc.aname[2] procppp=%proc.aname[3] procpppp=%proc.aname[4] command=%proc.cmdline\
+    \ connection=%fd.name container_infos=%container.info container=%container.name\
+    \ image=%container.image.repository:%container.image.tag)"
+  priority: "NOTICE"
+  tags:
+  - "gke"
+  - "container"
+  - "mitre_discovery"
+  - "network"
+  append: false
+
+- macro: "mariadb_snapshots"
+  condition: "(container.image.repository=\"mariadb\" and container.name contains\
+    \ \"snapshot-validated\") or (container.image.repository=\"mariadb\" and proc.name=\"\
+    sh\" and proc.pname=\"mysqld\")"
+  append: false
+
+- rule: "DB program spawned process"
+  condition: "and not mariadb_snapshots"
+  tags: []
+  append: true
+
+- macro: "user_known_clear_log_activities"
+  condition: "(container.image.repository=\"landoop/fast-data-dev\" and fd.name=\"\
+    /var/log/running-smart.log\")"
+  append: false
+
+- rule: "Clear Log Activities"
+  condition: "and not user_known_clear_log_activities"
+  tags: []
+  append: true
+
+- list: "user_known_sensitive_mount_images"
+  items:
+  - "newrelic/infrastructure-k8s"
+  - "quay.io/prometheus/node-exporter"
+  append: false
+
+- rule: "Create Sensitive Mount Pod"
+  condition: "and not ka.req.pod.containers.image.repository in (user_known_sensitive_mount_images)"
+  tags: []
+  append: true
+
+- macro: "user_shell_container_exclusions"
+  condition: "(container.image.repository=\"kong\" and proc.pname=\"nginx\")"
+  append: false
+
+- list: "user_known_privilged_k8s_roles"
+  items:
+  - "mariadb-moderation-snapshot-validated"
+  - "mariadb-payment-servix-snapshot-validated"
+  - "mariadb-user-activity-snapshot-validated"
+  - "mariadb-user-wallet-servix-snapshot-validated"
+  - "mariadb-log-snapshot-validated"
+  - "mariadb-monetize-servix-snapshot-validated"
+  - "mariadb-sesterce-snapshot-validated"
+  - "mariadb-reports-snapshot-validated"
+  - "mariadb-dev-snapshot-validated"
+  - "mariadb-main-snapshot-validated"
+  - "mariadb-components-snapshot-validated"
+  - "prometheus-operator-admission"
+  - "mariadb-monetize-servix-daily-copy"
+  - "mariadb-sesterce-daily-copy"
+  - "mariadb-main-daily-copy"
+  - "mariadb-components-daily-copy"
+  - "mariadb-log-daily-copy"
+  - "mariadb-reports-daily-copy"
+  - "mariadb-moderation-daily-copy"
+  - "mariadb-payment-servix-daily-copy"
+  append: false
+
+- rule: "ClusterRole With Write Privileges Created"
+  condition: "and not ka.target.name in (user_known_privilged_k8s_roles)"
+  tags: []
+  append: true
+
+- macro: "user_known_network_tool_activities"
+  condition: "(container.image.repository=\"mariadb\" and (proc.pname=\"wsrep_sst_maria\"\
+    \ or proc.pname=\"timeout\") and proc.name=\"socat\")"
+  append: false
+
+- macro: "user_shell_container_exclusions"
+  condition: "(container.image.repository=\"mariadb\" and proc.pname=\"mysqld\" and\
+    \ proc.name=\"sh\")"
+  append: false
+
+- macro: "user_known_remote_file_copy_activities"
+  condition: "(container.image.repository=\"eu.gcr.io/bbc-registry/command-export-russian-user\"\
+    \ and proc.name=\"sftp\")"
+  append: false
+
+- rule: "Launch Remote File Copy Tools in Container"
+  condition: "and not user_known_remote_file_copy_activities"
+  tags: []
+  append: true
+
+- macro: "user_known_container_drift_open_create_activities"
+  condition: "(container.image.repository=\"docker.elastic.co/elasticsearch/elasticsearch\"\
+    \ and evt.arg.filename startswith \"/usr/share/elasticsearch/data/nodes\")"
+  append: false
+
+- rule: "Container Drift Detected (open+create)"
+  condition: "and not user_known_container_drift_open_create_activities"
+  tags: []
+  append: true
+
+- macro: "user_known_container_drift_activities"
+  condition: "((container.image.repository=\"fluxcd/helm-operator\" and proc.name=\"\
+    git\" and evt.arg.filename endswith \"/.git/config\") or (container.image.repository=\"\
+    fluxcd/flux\" and proc.name=\"git\" and evt.arg.filename endswith \"/.git/config\"\
+    ) or (container.image.repository=\"k8s.gcr.io/fluentd-gcp-scaler\" and proc.name=\"\
+    kubectl\" and evt.arg.filename startswith \"/root/.kube/cache/discovery/\") or\
+    \ (container.image.repository=\"eu.gcr.io/bbc-registry/command-bnp-payout-report\"\
+    \ and proc.name=\"gpg-agent\" and evt.arg.filename startswith \"/root/.gnupg/\"\
+    ) or (container.image.repository=\"gcr.io/stackdriver-agents/stackdriver-logging-agent\"\
+    \ and evt.arg.filename startswith \"/var/run/google-fluentd/\") or (container.image.repository=\"\
+    weaveworks/prom-aggregation-gateway\" and proc.name=\"prom-aggregatio\" and evt.arg.filename\
+    \ startswith \"/var/lib/docker/\") or (container.image.repository=\"datadog/agent\"\
+    \ and proc.name=\"system-probe\" and evt.arg.filename startswith \"/var/run/sysprobe/\"\
+    ) or (container.image.repository=\"docker.elastic.co/elasticsearch/elasticsearch\"\
+    \ and proc.name=\"java\" and evt.arg.filename startswith \"/usr/share/elasticsearch/plugins/\"\
+    ) or (container.image.repository=\"docker.elastic.co/elasticsearch/elasticsearch\"\
+    \ and proc.name=\"cp\" and evt.arg.filename startswith \"/mnt/elastic-internal/elasticsearch-config-local/\"\
+    ) or (container.image.repository=\"istio/proxyv2\" and proc.name=\"pilot-agent\"\
+    \ and evt.arg.filename startswith \"/var/lib/docker/overlay2/\"))"
+  append: false
+
+- macro: "test_foo_bar"
+  condition: "never_true"
+  append: false