From 31f09721cd216924d15a9fa0fe0a0554210dfa96 Mon Sep 17 00:00:00 2001 From: poprhythm Date: Wed, 16 Sep 2026 23:19:54 +0000 Subject: [PATCH] falco: tune out host-reboot false positives from 2026-09-16 boot burst Host rebooted 2026-09-16 17:47 UTC, recreating every container at once and producing 70 alerts in a single burst - all traced to benign init-time patterns that will recur on every future reboot: systemd-executor's PAM reads during boot, firefly-iii/fidi's s6 healthcheck shell, and romm's own loopback redis/app connection at container start. --- falco/rules/tune-noise.yaml | 21 +++++++++++++++++++++ 1 file changed, 21 insertions(+) diff --git a/falco/rules/tune-noise.yaml b/falco/rules/tune-noise.yaml index ecd7819..afc07bd 100644 --- a/falco/rules/tune-noise.yaml +++ b/falco/rules/tune-noise.yaml @@ -15,10 +15,17 @@ # touch. Same pattern confirmed on calibre 2026-08-19; scoped per-image # rather than by proc.name alone since any other linuxserver.io image will # hit this the first time it's added here too. +# - systemd-executor (container_name=host): fired 63x reading /etc/shadow and +# every /etc/pam.d/* file during the 2026-09-16 17:47 host reboot, as every +# service's login/session setup ran at once. Normal PAM stack behavior at +# boot, not credential harvesting - will recur on every future reboot. +# Scoped by proc.exepath since proc.name is a meaningless re-exec artifact +# ("9") for systemd's own executor process during --deserialize. - macro: user_known_read_sensitive_files_activities condition: > (proc.name = pg_isready) or (container.image.repository in ("lscr.io/linuxserver/obsidian", "lscr.io/linuxserver/calibre") and proc.name = sed) + or (proc.exepath = "/usr/lib/systemd/systemd-executor") # "Fileless execution via memfd_create" fires from nvidia-ctk's # ldconfig-refresh hook, which runs via memfd_create by design every time @@ -65,10 +72,16 @@ # connection to the postgres container to poll for DB readiness, which # redirects stdio the same way a reverse shell would mechanically. Scoped # to the script's own cmdline, not the whole image. +# - rommapp/romm: its own init (bash /init) connects to its bundled loopback +# redis (127.0.0.1:6379) and app port (127.0.0.1:5000) at container start, +# same dup2-based mechanic. Confirmed at the 2026-09-16 host reboot; will +# recur on every container start. Scoped to the image, not proc.name, +# since this is the container's own /init script. - macro: user_known_stand_streams_redirect_activities condition: > (container.image.repository = "docker.gitea.com/gitea" and proc.name in (sshd, sshd-session)) or (container.image.repository = "fireflyiii/core" and proc.cmdline contains "wait-for-it.sh") + or (container.image.repository = "rommapp/romm" and proc.cmdline = "bash /init") # "Clear Log Activities" false-positive: lsyncd (host systemd service, not a # container - running since 2026-07-29) truncates its own status file, @@ -78,3 +91,11 @@ # other log-truncation in that directory still gets flagged. - macro: allowed_clear_log_files condition: (fd.name = "/var/log/lsyncd-status.log" and proc.name = lsyncd) + +# "Run shell untrusted" false-positive: fireflyiii/core and +# fireflyiii/data-importer's own s6 healthcheck (`sh ./data/check`, spawned +# by s6-notifyoncheck) fires twice per container start. Confirmed at the +# 2026-09-16 host reboot; will recur on every start. This list is the +# rule's own designated customization point (default: empty). +- list: user_known_shell_spawn_binaries + items: [s6-notifyoncheck]