elastic / elastic/integrations

[cloud_defend] LSM not supported on VMware Tanzu/Photon OS for Defend for Containers

Open
#17,518 1 comment 0 reactions 0 assignees View on GitHub
bug Integration:cloud_defend Team:Security-Linux Platform
Dominant language
Handlebars
Stars
333
Forks
647
Avg merge
2d 18h
Merged PRs (30d)
182

Description

### Integration Name

Defend for Containers (BETA) [cloud_defend]

### Dataset Name

cloud_defend.alerts, cloud_defend.file, cloud_defend.network

### Integration Version

1.4.0

### Agent Version

9.3

### Agent Output Type

elasticsearch

### Elasticsearch Version

9.3

### OS Version and Architecture

Vmware Tanzu Photon OS

### Software/API Version

_No response_

### Error Message

Unit state changed cloud_defend/control-default-cloud_defend/control-cloud_defend-86474a1b-c71e-42e2-bd3b-1b045eb3f415 (STARTING->FAILED): Startup error: load bpf progs (please ensure required Linux capabilities are set in k8s security context. BPF, PERFMON, and SYS_RESOURCE are mandatory): error loading eBPF probes: field BprmCheckSecurityTailCall0: program bprm_check_security_tail_call0: attach LSM/LSMMac: bprm_check_security LSM hook not supported

### Event Original

_No response_

### What did you do?

added the integration via fleet server to the our kubernetes policy and got this error.

### What did you see?

i got an unhealthy agent and this error: Unit state changed cloud_defend/control-default-cloud_defend/control-cloud_defend-86474a1b-c71e-42e2-bd3b-1b045eb3f415 (STARTING->FAILED): Startup error: load bpf progs (please ensure required Linux capabilities are set in k8s security context. BPF, PERFMON, and SYS_RESOURCE are mandatory): error loading eBPF probes: field BprmCheckSecurityTailCall0: program bprm_check_security_tail_call0: attach LSM/LSMMac: bprm_check_security LSM hook not supported

### What did you expect to see?

I expected Elastic Defend to work and capturing syscalls such as fields process.command_line being populated.

### Anything else?
yes. LSM is not needed for example telemetry syscalls and network connections. I believe the LSM is primarily for drift detection. so perhaps allow for an option to disable LSM so we can still use the telemetry of Elastic defend 4 containers
_No response_

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.