Feature/lab9

[sedimentt]

Goal

Detect container runtime behaviour with Falco, including two custom rules (a write under /tmp and likely cryptominer traffic), and enforce the same class of controls before deployment with a Conftest/Rego policy.

Changes

• labs/lab9/falco/rules/custom-rules.yaml — two custom Falco rules:
  • Write below tmp in container (WARNING, tags container, drift)
  • Possible cryptominer outbound connection (CRITICAL, tags mitre_command_and_c96)
• labs/lab9/policies/extra/hardening.rego — package k8s.hardechecks both contain
  • deny: image must be pinned by digest - warn: capabilities.add`
• submissions/lab9.md — report for Task 1, Task 2 and the Bonu

Testing

• Falco 0.43.1 with the modern eBPF probe, started with the lab command
• Built-in rules triggered:
  • docker exec -t n container
  • cat /etc/shadow → Read sensitive file untrusted
• echo test > /tmp/tmp in containerfired once
• nc -w 2 127.0.0.1 Possiblecryptominer outbound connection` (Critical)
• Negative checks: `o port 3333 → noCritical alert
• Evasion with a rensilent; caught byWrite below tmp and the built-in Drop and execute new binary in container
• Conftest 0.69.0, shipped policies only: - `juice-hardened.
  • juice-unhardened.yaml → 20 passed, 2 warnings, 8 failures - `juice-compose.y
• With extra/hardening.rego added: - `juice-hardened.
  • test manifest that violates the new rules → 2 failures, 1 warning (exit 1)
  • juice-unhardened.yaml → 9 failures - Found a bug in theL capabilities" rule(Kubernetes and Compose) stays silent when the drop field is missing entirely, because ofo. Documented in the report.

Artifacts & Screenshots

• Report: submissions/lab9.md
• Falco rules: labss.yaml
• Rego policy: labs/lab9/policies/extra/hardening.rego
• Alert log: labs/lsonl (kept locallyfor Lab 10, not committed per .gitignore)

Checklist

• Title is clear (feat(lab9): falco custom rules + conftest policy)
• No secrets/large temp files committed
• Submission filists