[json plugin error] json.value[...] doesn't accept json pointer #318

marco-zani · 2023-08-02T12:58:17Z

Describe the bug

When loading rules, falco finds the rules file as invalid with the following error:

LOAD_ERR_COMPILE_OUTPUT (Error compiling output):
 ....
 has an invalid index argument not composed only by digits: /user/extraauthentication.kubernetes.io/pod-name

How to reproduce it

Install the helm chart of falco with this config file:

falcoctl:
  artifact:
    install:
      enabled: true
    follow:
      enabled: true
  config:
    artifact:
      install:
        resolveDeps: false
        refs: [falco-rules:0, k8saudit-rules:0.5]
      follow:
        refs: [falco-rules:0, k8saudit-rules:0.5]

falco:
  plugins:
    - name: k8saudit
      library_path: libk8saudit.so
      init_config:
        ""
      open_params: "http://:9765/k8s-audit"
    - name: json
      library_path: libjson.so
      init_config: ""
      open_params: ""
  load_plugins: [k8saudit, json]

And with this rule in k8s_audit_rules.local.yaml:

- list: getVerbs
  items: [list, get]

- rule: getFromPod
  desc: A pod tried to access resorces in the cluster
  condition: ka.verb in (getVerbs) and ka.user.name != admin
  output: "%json.value[/user/extra/authentication.kubernetes.io/pod-name]"
  priority: info
  source: k8s_audit

and feeding falco with this json:

{
    "kind": "Event",
    "apiVersion": "audit.k8s.io/v1",
    "level": "Metadata",
    "auditID": "4d80af72-c845-42c3-9159-97a97925fcac",
    "stage": "ResponseComplete",
    "requestURI": "/api/v1/namespaces/default/pods?limit=500",
    "verb": "list",
    "user": {
        "username": "system:serviceaccount:default:default",
        "uid": "ff7eb48d-d26c-4b11-9f18-e2b5e9be50ee",
        "groups": [
            "system:serviceaccounts",
            "system:serviceaccounts:default",
            "system:authenticated"
        ],
        "extra": {
            "authentication.kubernetes.io/pod-name": [
                "ubuntu-ubuntu"
            ],
            "authentication.kubernetes.io/pod-uid": [
                "7d49c124-be01-4f95-827e-de1125f05dc9"
            ]
        }
    },
    "sourceIPs": [
        "10.1.134.102"
    ],
    "userAgent": "kubectl/v1.27.4 (linux/amd64) kubernetes/fa3d799",
    "objectRef": {
        "resource": "pods",
        "namespace": "default",
        "apiVersion": "v1"
    },
    "responseStatus": {
        "metadata": {},
        "code": 200
    },
    "requestReceivedTimestamp": "2023-08-02T08:12:31.920374Z",
    "stageTimestamp": "2023-08-02T08:12:31.925808Z",
    "annotations": {
        "authorization.k8s.io/decision": "allow",
        "authorization.k8s.io/reason": ""
    }
}

Expected behaviour

Return in output: ubuntu-ubuntu

Environment

Falco version:
0.35.1
System info:

Wed Aug  2 12:53:30 2023: Falco version: 0.35.1 (x86_64)
Wed Aug  2 12:53:30 2023: Falco initialized with configuration file: /etc/falco/falco.yaml
Wed Aug  2 12:53:30 2023: Loading plugin 'k8saudit' from file /usr/share/falco/plugins/libk8saudit.so
Wed Aug  2 12:53:30 2023: Loading plugin 'json' from file /usr/share/falco/plugins/libjson.so
Wed Aug  2 12:53:30 2023: Loading rules from file /etc/falco/falco_rules.yaml
Wed Aug  2 12:53:31 2023: Loading rules from file /etc/falco/local/falco_rules.local.yaml
Wed Aug  2 12:53:31 2023: Loading rules from file /etc/falco/k8s_audit_rules.yaml
{
  "machine": "x86_64",
  "nodename": "falco-vqvkp",
  "release": "5.15.0-76-generic",
  "sysname": "Linux",
  "version": "#83-Ubuntu SMP Thu Jun 15 19:16:32 UTC 2023"
}

this output is missing k8s_audit_rules.local.yaml because I had to remove it to access the machine

OS:

PRETTY_NAME="Debian GNU/Linux 11 (bullseye)"
NAME="Debian GNU/Linux"
VERSION_ID="11"
VERSION="11 (bullseye)"
VERSION_CODENAME=bullseye
ID=debian
HOME_URL="https://www.debian.org/"
SUPPORT_URL="https://www.debian.org/support"
BUG_REPORT_URL="https://bugs.debian.org/"

Kernel:
Linux falco-vqvkp 5.15.0-76-generic #83-Ubuntu SMP Thu Jun 15 19:16:32 UTC 2023 x86_64 GNU/Linux
Installation method:
helm chart

The text was updated successfully, but these errors were encountered:

poiana · 2023-10-31T15:46:01Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana · 2023-11-30T15:46:50Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

poiana · 2023-12-30T15:47:39Z

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

poiana · 2023-12-30T15:47:42Z

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Andreagit97 · 2024-01-03T10:18:30Z

/remove-lifecycle rotten

Andreagit97 · 2024-01-03T10:19:18Z

/reopen

poiana · 2024-01-03T10:19:21Z

@Andreagit97: Reopened this issue.

In response to this:

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Andreagit97 · 2024-01-03T10:21:40Z

Sounds like a valid issue! I'm not sure it ever worked...we will take a look, thank you for reporting!

poiana · 2024-04-02T15:50:44Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

poiana · 2024-05-02T15:52:29Z

Stale issues rot after 30d of inactivity.

Mark the issue as fresh with /remove-lifecycle rotten.

Rotten issues close after an additional 30d of inactivity.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle rotten

poiana · 2024-06-01T15:53:22Z

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

poiana · 2024-06-01T15:53:25Z

@poiana: Closing this issue.

In response to this:

Rotten issues close after 30d of inactivity.

Reopen the issue with /reopen.

Mark the issue as fresh with /remove-lifecycle rotten.

Provide feedback via https://github.com/falcosecurity/community.
/close

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

Andreagit97 · 2024-06-03T08:03:58Z

/remove-lifecycle rotten

/reopen

poiana · 2024-06-03T08:04:03Z

@Andreagit97: Reopened this issue.

In response to this:

/remove-lifecycle rotten

/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

poiana · 2024-09-01T10:10:27Z

Issues go stale after 90d of inactivity.

Mark the issue as fresh with /remove-lifecycle stale.

Stale issues rot after an additional 30d of inactivity and eventually close.

If this issue is safe to close now please do so with /close.

Provide feedback via https://github.com/falcosecurity/community.

/lifecycle stale

marco-zani added the kind/bug Something isn't working label Aug 2, 2023

poiana added the lifecycle/stale label Oct 31, 2023

poiana added lifecycle/rotten and removed lifecycle/stale labels Nov 30, 2023

poiana closed this as completed Dec 30, 2023

poiana removed the lifecycle/rotten label Jan 3, 2024

poiana reopened this Jan 3, 2024

poiana added the lifecycle/stale label Apr 2, 2024

poiana added lifecycle/rotten and removed lifecycle/stale labels May 2, 2024

poiana closed this as completed Jun 1, 2024

poiana reopened this Jun 3, 2024

poiana removed the lifecycle/rotten label Jun 3, 2024

poiana added the lifecycle/stale label Sep 1, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[json plugin error] json.value[...] doesn't accept json pointer #318

[json plugin error] json.value[...] doesn't accept json pointer #318

marco-zani commented Aug 2, 2023

poiana commented Oct 31, 2023

poiana commented Nov 30, 2023

poiana commented Dec 30, 2023

poiana commented Dec 30, 2023

Andreagit97 commented Jan 3, 2024

Andreagit97 commented Jan 3, 2024

poiana commented Jan 3, 2024

Andreagit97 commented Jan 3, 2024 •

edited

Loading

poiana commented Apr 2, 2024

poiana commented May 2, 2024

poiana commented Jun 1, 2024

poiana commented Jun 1, 2024

Andreagit97 commented Jun 3, 2024

poiana commented Jun 3, 2024

poiana commented Sep 1, 2024

[json plugin error] json.value[...] doesn't accept json pointer #318

[json plugin error] json.value[...] doesn't accept json pointer #318

Comments

marco-zani commented Aug 2, 2023

poiana commented Oct 31, 2023

poiana commented Nov 30, 2023

poiana commented Dec 30, 2023

poiana commented Dec 30, 2023

Andreagit97 commented Jan 3, 2024

Andreagit97 commented Jan 3, 2024

poiana commented Jan 3, 2024

Andreagit97 commented Jan 3, 2024 • edited Loading

poiana commented Apr 2, 2024

poiana commented May 2, 2024

poiana commented Jun 1, 2024

poiana commented Jun 1, 2024

Andreagit97 commented Jun 3, 2024

poiana commented Jun 3, 2024

poiana commented Sep 1, 2024

Andreagit97 commented Jan 3, 2024 •

edited

Loading