aquasecurity / aquasecurity/tracee

Container/pods filters implicitly exclude host events

Open
#5,224 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Go
Stars
4.6k
Forks
507
Avg merge
2d 8h
Merged PRs (30d)
9

Description

Hi,

While using Tracee, I noticed that enabling filters on containers and/or pods implicitly disables events that are not container-related.

For example, consider the following policy:

```
apiVersion: tracee.aquasec.com/v1beta1
kind: Policy
metadata:
annotations:
description: process execution tracking
name: process-exec
spec:
rules:
- event: sched_process_exec
filters:
- podNamespace!=kube-system
scope:
- global
```

This policy automatically filters out all events originating from the host. As a result, I receive events only from pods that are not in the `kube-system` namespace, but I do not receive any events occurring outside of containers.

To capture host events, I am forced to create an additional policy to compensate for this behavior:

```
apiVersion: tracee.aquasec.com/v1beta1
kind: Policy
metadata:
annotations:
description: process execution tracking
name: process-exec
spec:
rules:
- event: sched_process_exec
scope:
- not-container
```

this the intended behavior? I believe users should be able to apply container-related filters without implicitly restricting the policy to container-only events.

I suspect this behavior originates from [this lines of code](https://github.com/aquasecurity/tracee/blob/c5ddecd6ef324113a7f2695e8528106ca24e90d5/pkg/filters/scope.go#L226) line of code.

What do you think?

Thanks

Contributor guide

Open the contributing guide

Research direction

Start in pkg/filters/scope.go around line 226 and reproduce the two policy examples with sched_process_exec. Trace how the podNamespace!=kube-system filter affects host events, then inspect relevant filter tests for expected host and container coverage. Done means container or pod filters no longer implicitly exclude host events, with the behavior covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
go, kubernetes, linux
Domain
operating-systems, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.