Feature/lab9

[raaller]

Goal

Deliver Lab 9 runtime detection with Falco 0.43.1 and the modern eBPF probe, custom runtime rules, Conftest/Rego hardening policies, and the bonus cryptominer detection rule.

Changes

• Added submissions/lab9.md with modern eBPF evidence, two built-in Falco alerts, the custom /tmp alert, Conftest results, tuning discussion, and bonus cryptominer evidence.
• Added labs/lab9/falco/rules/custom-rules.yaml with Write to /tmp by container and Possible Cryptominer Activity rules.
• Added labs/lab9/policies/extra/hardening.rego with checks for non-root execution, disabled privilege escalation, dropped Linux capabilities, and memory limits.

Testing

# Falco modern eBPF initialization
docker logs falco 2>&1 | grep "Opening 'syscall' source with modern BPF probe"
# Observed: Opening 'syscall' source with modern BPF probe.

# Baseline and custom Falco alerts
grep -E 'Terminal shell in container|Read sensitive file untrusted|Write to /tmp by container|Possible Cryptominer Activity' \
  labs/lab9/falco/logs/falco.log
# Observed: all four required alerts fired.

# Hardened Kubernetes manifest
conftest test labs/lab9/manifests/k8s/juice-hardened.yaml \
  --policy labs/lab9/policies/extra/
# Observed: 8 tests, 8 passed, 0 failures.

# Unhardened Kubernetes manifest
conftest test labs/lab9/manifests/k8s/juice-unhardened.yaml \
  --policy labs/lab9/policies/extra/
# Observed: 4 policy failures:
# - runAsNonRoot must be true
# - allowPrivilegeEscalation must be false
# - capabilities.drop must include ALL
# - resources.limits.memory must be set

# Hardened Compose manifest
conftest test labs/lab9/manifests/compose/juice-compose.yml \
  --policy labs/lab9/policies/compose-security.rego \
  --namespace compose.security
# Observed: 4 tests, 4 passed, 0 failures.

# Deliberately unhardened Compose manifest
conftest test /tmp/bad-compose.yml \
  --policy labs/lab9/policies/compose-security.rego \
  --namespace compose.security
# Observed: 2 policy failures for missing non-root user and read_only: true.

Artifacts & Screenshots

• submissions/lab9.md — complete report and captured runtime evidence.
• labs/lab9/falco/rules/custom-rules.yaml — custom Falco rules.
• labs/lab9/policies/extra/hardening.rego — Kubernetes Conftest policies.
• No screenshots were required; the submission contains the relevant Falco JSON alerts and Conftest output.

Checklist

[x] Title is clear (feat(lab9): falco runtime detection and conftest policies)
[x] No secrets/large temp files committed
[x] Submission file at submissions/lab9.md exists
[x] Task 1 — 2 baseline + 1 custom Falco alert with tuning discussion
[x] Task 2 — 4 Conftest rules, K8s pass/fail, and Compose pass/fail
[x] Bonus — 2 indicator classes, triggered alert, false-negative and SLA reflection