feat(lab9): falco custom rules + conftest hardening policies + bonus …

[Wilikson173]

feat(lab9): falco custom rules + conftest hardening policies + bonus cryptominer detection

Goal

Deploy Falco (modern eBPF) for runtime threat detection with custom rules, and write Conftest/Rego policies to gate Kubernetes manifests at CI time.

Changes

• labs/lab9/falco/rules/custom-rules.yaml — added custom rule "Write to /tmp by container" (detects writes to /tmp inside containers, priority WARNING, tags [container, drift])
• labs/lab9/falco/rules/cryptominer-rules.yaml — added bonus rule "Possible Cryptominer Activity" combining two indicators (known miner/nc process names via proc.name, and outbound connections to common mining-pool ports via fd.rport), priority CRITICAL
• labs/lab9/policies/extra/hardening.rego — added 4 Conftest deny rules: runAsNonRoot must be true, allowPrivilegeEscalation must be false, capabilities.drop must include ALL, and resources.limits.memory must be set
• submissions/lab9.md — full writeup with captured alerts, policy file, Conftest test output, and tuning/reflection discussion

Testing

Falco baseline alerts
docker run -d --name lab9-target alpine:3.20 sleep 1d
docker run -d --name falco --privileged
-v /proc:/host/proc:ro -v /boot:/host/boot:ro
-v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro
-v /var/run/docker.sock:/host/var/run/docker.sock
-v "$(pwd)/labs/lab9/falco/rules":/etc/falco/rules.d:ro
falcosecurity/falco:0.43.1 falco -U -o json_output=true -o time_format_iso_8601=true
docker exec -it lab9-target /bin/sh -lc 'echo "shell-in-container test"'
docker exec --user 0 lab9-target /bin/sh -lc 'echo "test" > /tmp/my-write.txt'
grep '^{' labs/lab9/falco/logs/falco.log | jq -c '.rule' | sort -u
-> "Terminal shell in container"
-> "Write to /tmp by container"
Bonus: cryptominer detection
docker exec lab9-target /bin/sh -c 'nc -zv 8.8.8.8 3333 2>&1 || true'
grep '^{' labs/lab9/falco/logs/falco.log | jq -c 'select(.rule == "Possible Cryptominer Activity")'
-> fires with proc=nc cmdline="nc -zv 8.8.8.8 3333"
Conftest policy tests
conftest test labs/lab9/manifests/good-pod.yaml --policy labs/lab9/policies/extra/
-> 4 tests, 4 passed, 0 failures
conftest test labs/lab9/manifests/bad-pod-runasroot.yaml --policy labs/lab9/policies/extra/
-> FAIL: DENY: Pod must have runAsNonRoot = true (4 tests, 3 passed, 1 failure)
conftest test labs/lab9/manifests/bad-pod-no-resources.yaml --policy labs/lab9/policies/extra/
-> FAIL: DENY: Container 'app' must have memory limits (4 tests, 3 passed, 1 failure)

Artifacts & Screenshots

• submissions/lab9.md
• labs/lab9/falco/rules/custom-rules.yaml
• labs/lab9/falco/rules/cryptominer-rules.yaml
• labs/lab9/policies/extra/hardening.rego

---

Checklist

• Title follows feat(labN): <topic> style
• No secrets or large temp files committed
• Submission file exists at submissions/lab9.md