gvisor.dev/gvisor@v0.0.0-20240520182842-f9d4d51c7e0f/website/blog/2022-08-31-threat-detection.md (about)

     1  # Threat Detection in gVisor
     2  
     3  gVisor helps users secure their infrastructure by running containers in a
     4  dedicated kernel that is isolated from the host. But wouldn't it be nice if you
     5  could tell when someone attempts to break out? Or get an early warning that your
     6  web server might have been compromised? Now you can do it with gVisor! We are
     7  pleased to announce support for **runtime monitoring**. Runtime monitoring
     8  provides the ability for an external process to observe application behavior and
     9  detect threats at runtime. Using this mechanism, gVisor users can watch actions
    10  performed by the container and generate alerts when something unexpected occurs.
    11  
    12  A monitoring process can connect to the gVisor sandbox and receive a stream of
    13  actions that the application is performing. The monitoring process decides what
    14  actions are allowed and what steps to take based on policies for the given
    15  application. gVisor communicates with the monitoring process via a simple
    16  protocol based on
    17  [Protocol Buffers](https://developers.google.com/protocol-buffers), which is the
    18  basis for [gRPC](https://grpc.io/) and is well supported in several languages.
    19  The monitoring process runs isolated from the application inside the sandbox for
    20  security reasons, and can be shared among all sandboxes running on the same
    21  machine to save resources. Trace points can be individually configured when
    22  creating a tracing session to capture only what's needed.
    23  
    24  Let's go over a simple example of a web server that gets compromised while being
    25  monitored. The web server can execute files from `/bin`, read files from `/etc`
    26  and `/html` directories, create files under `/tmp`, etc. All these actions are
    27  reported to a monitoring process which analyzes them and deems them normal
    28  application behavior. Now suppose that an attacker takes control over the web
    29  server and starts executing code inside the container. The attacker writes a
    30  script under `/tmp` and, in an attempt to make it executable, runs `chmod u+x
    31  /tmp/exploit.sh`. The monitoring process determines that making a file
    32  executable is not expected in the normal web server execution and raises an
    33  alert to the security team for investigation. Additionally, it can also decide
    34  to kill the container and stop the attacker from making more progress.
    35  
    36  ## Falco
    37  
    38  [Falco](https://falco.org/) is an Open Source Cloud Native Security monitor that
    39  detects threats at runtime by observing the behavior of your applications and
    40  containers. Falco
    41  [supports monitoring applications running inside gVisor](https://falco.org/blog/falco-0-32-1/).
    42  All the Falco rules and tooling work seamlessly with gVisor. You can use
    43  [this tutorial](https://gvisor.dev/docs/tutorials/falco/) to learn how to
    44  configure Falco and gVisor together. More information can be found on the
    45  [Falco blog](https://falco.org/blog/intro-gvisor-falco/).
    46  
    47  ## What's next?
    48  
    49  We're looking for more projects to take advantage of the runtime monitoring
    50  system and the visibility that it provides into the sandbox. There are a few
    51  unique capabilities provided by the system that makes it easy to monitor
    52  applications inside gVisor, like resolving file descriptors to full paths,
    53  providing container ID with traces, separating processes that were exec'ed into
    54  the container, internal procfs state access, and many more.
    55  
    56  If you would like to explore it further, there is a
    57  [design document](https://docs.google.com/document/d/1RQQKzeFpO-zOoBHZLA-tr5Ed_bvAOLDqgGgKhqUff2A)
    58  and
    59  [documentation](https://github.com/google/gvisor/tree/master/pkg/sentry/seccheck/README.md)
    60  with more details about the configuration and communication protocol. In
    61  addition, the [tutorial using Falco](https://gvisor.dev/docs/tutorials/falco/)
    62  is a great way to see it in action.
    63  
    64  We would like to thank [Luca Guerra](https://github.com/LucaGuerra),
    65  [Lorenzo Susini](https://github.com/loresuso), and the Falco team for their
    66  support while building this feature.