Falco not writing to logs about a file being edited

Question

I have deployed falco as a side car to my work load in EKS/Fargate. Falco is able to execute the script that is defined in the image but not able to monitor workload container in runtime, meaning if I create a file at a location defined in the rules its not writing anything to logs about the new file. Details below

created falco image using https://github.com/aws-samples/aws-fargate-falco-examples/blob/main/containerimages/sidecarptrace/Dockerfile.workload

Use this falco image to deploy it as sidecar along with our workload containerimages/sidecarptrace/Dockerfile

In workload image, we are triggering falco using below
##############################################################################################
COPY --from=falcosecurity/falco-userspace:latest /vendor/falco/bin/pdig /vendor/falco/bin/pdig
COPY ./myscript.sh  /vendor/falco/scripts/myscript.sh
RUN chown -R nginx:nginx /vendor/falco/scripts/myscript.sh
RUN chmod 755 /vendor/falco/scripts/myscript.sh
CMD ["/vendor/falco/bin/pdig", "/bin/bash", "/vendor/falco/scripts/myscript.sh"]
##################################################################################################

For better understanding, below is how pod.yaml looks like
    containers:
    - name: falco
      image: 111111111111.dkr.ecr.us-east-1.amazonaws.com/xxxxxxxxx:sidecarptracefalco
      volumeMounts:
        - name: falco-config
          mountPath: "/data/falco.yaml"
          subPath: "falco.yaml"
          readOnly: true
        - name: falco-local-rules
          mountPath: "/data/falco_rules.local.yaml"
          subPath: "falco_rules.local.yaml"
          readOnly: true

    - name: nginx
      image: 11111111111111.dkr.ecr.us-east-1.amazonaws.com/xxxxxxxxxxxxx:bfde44a3

Deployed falco.yaml and falco-local-rules.yaml from https://github.com/aws-samples/aws-fargate-falco-examples/tree/main/podspecs

What I am noticing is
    myscript.sh runs correctly and only those are being logged in falco container logs. 
    If I create a shell script under /etc/nginx/html and execute it using sh /etc/nginx/html/test.sh, nothing is logged 
What I want is
    Falco to continously monitor workload container and log it

If the CMD in workload image needs an update to implement the continous monitoring, need guidance of how to do that

I am expecting any file creation or editing a file should be logged by falco

Falco not writing to logs about a file being edited

0 Answers0