From 33868ee9bbee91b82a6104f7d64b2708d891daf2 Mon Sep 17 00:00:00 2001 From: poprhythm Date: Sun, 16 Aug 2026 15:25:04 +0000 Subject: [PATCH] falco: tune out gitea SSH and firefly-iii wait-for-it.sh stdio redirects "Redirect STDOUT/STDIN to Network Connection in Container" (a reverse-shell detector) was firing legitimately: gitea's sshd/sshd-session dup2 the accepted SSH socket onto stdio for every session (4x per connection), and firefly-iii's wait-for-it.sh does the same TCP-readiness-check dance while waiting for postgres. Both confirmed recurring via netdata's alert history, not one-off. Scoped exceptions added to each's specific binary/cmdline, not the whole container/image. Verified: a gitea SSH login no longer alerts, while a real dup2-based redirect (bash's /dev/tcp exec pattern) from an unrelated container still fires - the exception is narrow, not a blanket disable. "Run shell untrusted" was also flagged as noisy, but investigation showed it fired exactly once, during my own rule-testing window, and never before or since - left alone rather than building a permanent exception for a self-caused test artifact. --- falco/rules/tune-noise.yaml | 17 +++++++++++++++++ 1 file changed, 17 insertions(+) diff --git a/falco/rules/tune-noise.yaml b/falco/rules/tune-noise.yaml index 7770a31..dafb2ce 100644 --- a/falco/rules/tune-noise.yaml +++ b/falco/rules/tune-noise.yaml @@ -49,3 +49,20 @@ (container.image.repository = "docker.gitea.com/gitea" and proc.name = gitea) or (container.image.repository = "lscr.io/linuxserver/obsidian") or (container.image.repository = "tsl0922/ttyd" and proc.name in (telnet, pv, busybox-extras)) + +# "Redirect STDOUT/STDIN to Network Connection in Container" false-positives, +# both confirmed recurring (not one-off) via netdata's alert history: +# - gitea: sshd/sshd-session redirect the just-accepted SSH connection's +# socket onto stdin/stdout/stderr via dup2 - this is simply how every SSH +# server handles every session, not a reverse shell. Fires 4x per SSH +# connection (sshd x2, sshd-session x2). Scoped to those two binaries in +# this one container, not the whole image, since gitea itself spawning +# this pattern from some other binary would still be worth flagging. +# - fireflyiii/core: its wait-for-it.sh startup script opens a raw TCP +# connection to the postgres container to poll for DB readiness, which +# redirects stdio the same way a reverse shell would mechanically. Scoped +# to the script's own cmdline, not the whole image. +- macro: user_known_stand_streams_redirect_activities + condition: > + (container.image.repository = "docker.gitea.com/gitea" and proc.name in (sshd, sshd-session)) + or (container.image.repository = "fireflyiii/core" and proc.cmdline contains "wait-for-it.sh")