aquasecurity / aquasecurity/tracee
Container/pods filters implicitly exclude host events
- Dominant language
- Go
- Stars
- 4.6k
- Forks
- 507
- Avg merge
- 2d 8h
- Merged PRs (30d)
- 9
Description
Hi,
While using Tracee, I noticed that enabling filters on containers and/or pods implicitly disables events that are not container-related.
For example, consider the following policy:
```
apiVersion: tracee.aquasec.com/v1beta1
kind: Policy
metadata:
annotations:
description: process execution tracking
name: process-exec
spec:
rules:
- event: sched_process_exec
filters:
- podNamespace!=kube-system
scope:
- global
```
This policy automatically filters out all events originating from the host. As a result, I receive events only from pods that are not in the `kube-system` namespace, but I do not receive any events occurring outside of containers.
To capture host events, I am forced to create an additional policy to compensate for this behavior:
```
apiVersion: tracee.aquasec.com/v1beta1
kind: Policy
metadata:
annotations:
description: process execution tracking
name: process-exec
spec:
rules:
- event: sched_process_exec
scope:
- not-container
```
this the intended behavior? I believe users should be able to apply container-related filters without implicitly restricting the policy to container-only events.
I suspect this behavior originates from [this lines of code](https://github.com/aquasecurity/tracee/blob/c5ddecd6ef324113a7f2695e8528106ca24e90d5/pkg/filters/scope.go#L226) line of code.
What do you think?
Thanks
Contributor guide
Research direction
Start in pkg/filters/scope.go around line 226 and reproduce the two policy examples with sched_process_exec. Trace how the podNamespace!=kube-system filter affects host events, then inspect relevant filter tests for expected host and container coverage. Done means container or pod filters no longer implicitly exclude host events, with the behavior covered by a regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go, kubernetes, linux
- Domain
- operating-systems, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100