The Eye of Falco: You Can Escape but Not Hide
summary
Falco is extended to track Linux capabilities at runtime by building initial state from /proc and instrumenting syscalls (fork/clone/execve/capset) so rules can read effective/permitted/inheritable sets. New detections flag containers that gain cap_sys_module, cap_sys_ptrace or cap_sys_admin and spot the cgroup release_agent exploit flow; rules combine capability checks plus file writes to keep false positives low. Deployment uses Falco’s kernel probe or eBPF (needs elevated privileges) and is available via Helm charts.
AI-written summary · about
chapters (8)
- 0:00Container security & Falco
- 3:14Linux capabilities
- 8:38Capabilities in security
- 10:06Container escapes via capabilities
- 17:41Detecting capability attacks
- 18:02Extending Falco for capabilities
- 23:03Falco rules for capabilities
- 25:34Q&A
related talks
27mIntro: Falco
36mBypass Falco
25mUse Falco and eBPF to protect your applications
39mDeep Dive: Falco
30mIn the Eye of Falco: Transforming Your View of Linux Kernel Security
27mFalco meets MITRE - Run any Falco Installation against Atomic Red
36mIntro: Falco
33mFIND, FOCUS, and FIX the Container and Cloud Threats that Matter