elastic / elastic/integrations
[cloud_defend] LSM not supported on VMware Tanzu/Photon OS for Defend for Containers
- Dominant language
- Handlebars
- Stars
- 333
- Forks
- 647
- Avg merge
- 2d 18h
- Merged PRs (30d)
- 182
Description
### Integration Name
Defend for Containers (BETA) [cloud_defend]
### Dataset Name
cloud_defend.alerts, cloud_defend.file, cloud_defend.network
### Integration Version
1.4.0
### Agent Version
9.3
### Agent Output Type
elasticsearch
### Elasticsearch Version
9.3
### OS Version and Architecture
Vmware Tanzu Photon OS
### Software/API Version
_No response_
### Error Message
Unit state changed cloud_defend/control-default-cloud_defend/control-cloud_defend-86474a1b-c71e-42e2-bd3b-1b045eb3f415 (STARTING->FAILED): Startup error: load bpf progs (please ensure required Linux capabilities are set in k8s security context. BPF, PERFMON, and SYS_RESOURCE are mandatory): error loading eBPF probes: field BprmCheckSecurityTailCall0: program bprm_check_security_tail_call0: attach LSM/LSMMac: bprm_check_security LSM hook not supported
### Event Original
_No response_
### What did you do?
added the integration via fleet server to the our kubernetes policy and got this error.
### What did you see?
i got an unhealthy agent and this error: Unit state changed cloud_defend/control-default-cloud_defend/control-cloud_defend-86474a1b-c71e-42e2-bd3b-1b045eb3f415 (STARTING->FAILED): Startup error: load bpf progs (please ensure required Linux capabilities are set in k8s security context. BPF, PERFMON, and SYS_RESOURCE are mandatory): error loading eBPF probes: field BprmCheckSecurityTailCall0: program bprm_check_security_tail_call0: attach LSM/LSMMac: bprm_check_security LSM hook not supported
### What did you expect to see?
I expected Elastic Defend to work and capturing syscalls such as fields process.command_line being populated.
### Anything else?
yes. LSM is not needed for example telemetry syscalls and network connections. I believe the LSM is primarily for drift detection. so perhaps allow for an option to disable LSM so we can still use the telemetry of Elastic defend 4 containers
_No response_
Contributor guide
Assessment
This issue has not been assessed yet.