运行时安全监控

运行时安全监控可检测容器异常行为，下面介绍集成方法。

Falco

部署 Falco

# helm install falco falcosecurity/falco
# 或 docker 部署
docker run -d --name falco \
  --privileged \
  -v /var/run/docker.sock:/var/run/docker.sock \
  -v /proc:/host/proc:ro \
  -v /boot:/host/boot:ro \
  falcosecurity/falco:latest

规则配置

# /etc/falco/falco_rules.yaml
- rule: Terminal shell in container
  desc: A shell was used in a container
  condition: >
    spawned_process and container and
    proc.name in (bash, sh, zsh)    
  output: >
    Shell spawned in container
    (user=%user.name container=%container.name
    shell=%proc.name parent=%proc.pname
    cmdline=%proc.cmdline)    
  priority: WARNING
  tags: [container, shell]

eBPF 监控

什么是 eBPF

eBPF (Extended Berkeley Packet Filter) 是 Linux 内核沙箱，可在内核运行代码而不修改内核源码。

bpftrace 工具

# 安装 bpftrace
sudo apt-get install bpftrace

# 监控容器进程创建
bpftrace -e '
  tracepoint:sched:sched_process_exec
  /args->filename == "/bin/bash"/
  {
    printf("Container exec: %s\n", args->filename);
  }
'

异常检测

进程异常

# Falco 规则：检测异常进程
- rule: Unexpected process
  condition: >
    spawned_process and container and
    not proc.name in (allowed_procs)    
  output: Unexpected process (container=%container.name proc=%proc.name)
  priority: CRITICAL

网络异常

# 检测异常网络连接
- rule: Outbound connection from container
  condition: >
    outbound and container and
    not fd.sip in (allowed_ips)    
  output: Outbound connection (container=%container.name ip=%fd.sip)
  priority: WARNING

文件异常

# 检测敏感文件访问
- rule: Sensitive file access
  condition: >
    open_read and container and
    fd.name startswith /etc/shadow    
  output: Sensitive file read (container=%container.name file=%fd.name)
  priority: CRITICAL

集成告警

Slack 通知

# /etc/falco/falco.yaml
http_output:
  enabled: true
  url: "https://hooks.slack.com/services/XXX/YYY/ZZZ"

Prometheus 集成

# falco-exporter
# 导出 Falco 事件到 Prometheus

# Grafana 仪表板
# 可视化容器安全事件

监控指标

要点总结

• Falco 是容器运行时安全监控工具，基于规则检测异常行为
• eBPF 提供内核级监控，无需修改内核源码
• 规则检测异常进程、网络、文件访问
• 集成 Slack/Prometheus 实现告警和可视化
• 生产环境必须部署运行时监控，实时检测入侵