feat(lab9): falco custom rules + conftest hardening policies

[PollyS6]

Goal

Security monitoring with Falco and Kubernetes manifest hardening with Conftest policies

Changes

• labs/lab9/falco/rules/custom-rules.yaml
• labs/lab9/policies/extra/hardening.rego
• submissions/lab9.md

Testing

• Commands:
• docker exec -it lab9-target /bin/sh -lc 'echo "shell-in-container test"
• docker exec lab9-target /bin/sh -lc 'cat /etc/shadow'
• grep -E "(Terminal shell|Read sensitive file)" labs/lab9/falco/logs/falco.log | head -10
• conftest test labs/lab9/manifests/k8s/juice-hardened.yaml --policy labs/lab9/policies/extra/
• conftest test labs/lab9/manifests/k8s/juice-unhardened.yaml --policy labs/lab9/policies/extra/
• conftest test labs/lab9/manifests/compose/juice-compose.yml --policy labs/lab9/policies/compose-security.rego --namespace compose.security
• conftest test /tmp/bad-compose.yml --policy labs/lab9/policies/compose-security.rego --namespace compose.security
• Observed output:
• rules were triggered
• hardened manifest passed all checks, unhardened failed
• good compose file passed all checks and the bad oen did not

Artifacts & Screenshots

[]

• https://github.com/PollyS6/DevSecOps-Intro/tree/feature/lab9/labs/lab9

Checklist

• Title is clear (feat(labN): style)
• No secrets/large temp files committed
• Submission file at submissions/labN.md exists
• Task 1 — 2 baseline + 1 custom Falco alert with tuning discussion
• Task 2 — ≥3 Conftest rules (K8s pass/fail) + shipped compose policy run
• Bonus — Cryptominer detection rule with triggered alert