---
# System prepended metadata

title: KubeArmor Fargate Integration

---

# KubeArmor Fargate Integration

### Problem Statement

Secure workloads on managed service providers like AWS Fargate where we don't have access to Linux Primitives or Host to probe information from

## Requirements

- Entrypoint Modification
- Sidecar addition
- CAP_SYS_PTRACE

## Design

### Whether to create new repo or modify KubeArmor/KubeArmor?

- We start with a new repo, create a POC and then see through this
    - As of now we think a small codebase is only needed to be duplicated which  can be refactored to be imported in general

## HLD

### EKS Fargate
https://excalidraw.com/#room=0017a2f420a3e729ed51,OBRbFxGFmOrV7raWnukP9g

![](https://i.imgur.com/398VyYL.png)

### ECS Fargate
https://excalidraw.com/#room=9502a5ac147969916938,4igqW9lvaRxAqglH-RJe3A

![](https://i.imgur.com/OqofV2g.png)

## TaskList/Misc Notes

Tasklist
- [x] 1. Check basic file/proc/net ops
- [x] 2. Check enforcement, how exactly do we permission denied leveraging ptrace
- [x] 3. Get an idea about how to leverage this inside a container to monitor and enforce every thing in the container
    - Probably check pdig and falco trace
    - https://github.com/krisnova/falco-trace/
    - https://github.com/falcosecurity/pdig
    - Verify if fargate allows to exec into a container
    - Check  https://github.com/fntlnz/falco-inject to see if we can run without modifying container
- [x] 4. Design how to exactly execute ptrace code and communicate inside and outside container
    - ~~Do we build everthing in C?~~ 
    - ~~Or we use C for only monitoring and enforcement and somehow converse between Go and C program~~
    - ~~How to deal with updating policy rules and things like that~~
    - NOO, We roll with GO
        - Leverage libbseccomp-go + std syscall
        - POC in progress at https://github.com/daemon1024/bluelock 
- [ ] 5. Check if all details available under each of the syscalls we are leveraging  or we need to create maps and  other things to share details across syscalls
    - Details like
        - Protocol in Network
        - Source process in file/net
                - Read only or write in file ops
- [ ] 6. Check path reconstruction logic for file/procs
    - Might need to leverage prepend path functions
- [x] 7. Design how to aggregate logs and send it to whatever or wherever we do
    - [x] sidecar and sidekick
    
    
Notes:
- FalcoSideKick running in sidecar
    - Need to modify sidekick to support KubeArmor telemetry data
    - Should be a quick change in the verification logic here
        - https://github.com/falcosecurity/falcosidekick/blob/80c0bc1489835ad7d60a4f2e103b20d5a3e7ea00/handlers.go#L43
- Where do  we get container information??
    - /proc/self/cgroup
    - https://stackoverflow.com/questions/20995351/how-can-i-get-docker-linux-container-information-from-within-the-container-itsel
- About Listening or Watching
    - If k8s available we leverage CRDs
    - Else we have a gRPC/HTTP listener which waits for some client to send policies
    - We check for config values to see if any policy exists before starting  the container
- Do we need Policy Matcher??
    - Can we add which policy we based our decision on in the sidecar??
    - Do we want to integrate default posture??
    - Do we want audit policies??
- Master Worker Architecture can cause issues, perhaps we have ephemeral pods/containers/tasks so let's keep each sidecar happen independently

Misc:

- ptrace + seccomp test - https://www.alfonsobeato.net/c/filter-and-modify-system-calls-with-seccomp-and-ptrace/
- Linux Syscall Table - https://chromium.googlesource.com/chromiumos/docs/+/master/constants/syscalls.md#x86_64-64_bit
- Go-sandbox - https://github.com/criyle/go-sandbox/tree/master/ptracer

Which syscalls to leverage
- open
- openat
- execve
- execveat
- connect
- accept

To be checked later
- unlink
- unlinkat
- bind
- listen
- read
- readlink

# Task List

1. Create a minimal observer and setup feeder infrastructure
    - Only observe execve
    - Fill up all the data we need for telemetry
    - Modify Sidekick
    - Try leveraging Slack/Discord/AWSCloudLogs
2. Set up rule watcher/listener infrastructure
    - rule watcher for k8s: test on eks fargate
    - listener: test on ecs fargate
3. Implement Enforcer
    - ptrace+seccomp
    - how to expose data?
    - where to have rule checking whether to allow or not

![](https://hackmd.io/_uploads/H1qTxhTr2.png)

![](https://hackmd.io/_uploads/r1CXZ2Tr2.png)

![](https://hackmd.io/_uploads/S12tfh6rn.png)

![](https://hackmd.io/_uploads/H1bh736Sh.png)

![](https://hackmd.io/_uploads/rJ4NN3aH2.png)




