🦅 Falco — Runtime Anomaly Detection

seccomp and AppArmor prevent bad syscalls before they happen. Falco (CNCF graduated) detects suspicious behaviour after it occurs — a complementary, detective control. It watches kernel syscalls and Kubernetes audit events and fires alerts when a rule matches.

Installing Falco (Helm)

helm repo add falcosecurity https://falcosecurity.github.io/charts
helm repo update

helm install falco falcosecurity/falco \
  --namespace falco --create-namespace \
  --set driver.kind=ebpf \
  --set falcosidekick.enabled=true \
  --set falcosidekick.webui.enabled=true

Anatomy of a Falco Rule

Rules are written in YAML and use a condition DSL that queries syscall fields:

# Built-in rule (simplified)
- rule: Terminal shell in container
  desc: A shell was opened interactively inside a running container
  condition: >
    spawned_process
    and container
    and shell_procs
    and proc.tty != 0
    and container_entrypoint
  output: >
    Shell opened in container (user=%user.name container=%container.name
    image=%container.image.repository pod=%k8s.pod.name ns=%k8s.ns.name
    shell=%proc.name cmdline=%proc.cmdline)
  priority: WARNING
  tags: [container, shell, mitre_execution]

Essential Built-in Rules to Know

Writing a Custom Falco Rule

# Custom rule: alert on unexpected outbound port from specific namespace
- macro: payment_service_pod
  condition: k8s.ns.name = "payments" and k8s.pod.name startswith "checkout-"

- rule: Unexpected egress from payments namespace
  desc: checkout pod made outbound connection on non-443/5432 port
  condition: >
    outbound
    and payment_service_pod
    and not fd.sport in (443, 5432)
  output: >
    Unexpected egress (pod=%k8s.pod.name dst=%fd.rip:%fd.rport
    proto=%fd.l4proto user=%user.name)
  priority: CRITICAL
  tags: [network, payments, custom]

Falco + Kubernetes Audit Events

Falco can also consume Kubernetes audit log events (via a webhook backend) to detect control-plane level threats — not just node-level syscalls:

# kube-apiserver audit webhook → Falco
# Add to kube-apiserver flags:
--audit-webhook-config-file=/etc/kubernetes/falco-webhook.yaml
--audit-policy-file=/etc/kubernetes/audit-policy.yaml

# falco-webhook.yaml points to Falco's k8s audit webhook endpoint
apiVersion: v1
kind: Config
clusters:
- cluster:
    server: http://falco.falco.svc:8765/k8s-audit
  name: falco

🔒 AppArmor Profiles

AppArmor is the default Linux Security Module (LSM) on Ubuntu and Debian — which means most managed Kubernetes nodes (GKE, EKS with Ubuntu AMIs, AKS) have it available. It uses path-based rules to restrict what files and capabilities a container process can access.

Profile Modes

Loading a Profile on the Node

# Copy profile to node (or use Security Profiles Operator)
cat /etc/apparmor.d/myapp-profile
# Then load it:
apparmor_parser -r -W /etc/apparmor.d/myapp-profile
# Verify it loaded:
aa-status | grep myapp

Attaching an AppArmor Profile to a Container

As of Kubernetes 1.30, AppArmor is configured via securityContext.appArmorProfile (promoted from annotation). The annotation form still works on older clusters:

# Kubernetes 1.30+ native field
spec:
  containers:
  - name: app
    securityContext:
      appArmorProfile:
        type: Localhost
        localhostProfile: myapp-profile

# Legacy annotation (pre-1.30 / still works)
metadata:
  annotations:
    container.apparmor.security.beta.kubernetes.io/app: localhost/myapp-profile

Example AppArmor Profile

#include <tunables/global>
profile myapp-profile flags=(attach_disconnected) {
  #include <abstractions/base>

  ## allow read-only access to OS libraries
  /usr/lib/**  r,
  /lib/**      r,

  ## allow the app binary to execute
  /app/server  mrix,

  ## allow writes only to /tmp and /var/log/myapp/
  /tmp/**            rw,
  /var/log/myapp/**  rw,

  ## deny everything else implicitly (AppArmor default)
  deny /etc/shadow r,
  deny /proc/sys/** w,
}

🏷️ SELinux Context

SELinux is label-based: every process gets a type label and every file/socket gets a type label. The policy says which process types may access which resource types. It is the default LSM on RHEL, CentOS, Fedora, and Amazon Linux 2 nodes.

Setting SELinux Options in Kubernetes

apiVersion: v1
kind: Pod
spec:
  securityContext:
    seLinuxOptions:
      level: "s0:c123,c456"   # MCS label — isolates volumes between Pods
  containers:
  - name: app
    securityContext:
      seLinuxOptions:
        type:  "container_t"    # standard container type
        level: "s0:c123,c456"

SELinux vs AppArmor — Which One?

🧠 Knowledge Check