From 74fd121a74d7349ad1e558407e533ee83ebd6379 Mon Sep 17 00:00:00 2001 From: MayankSekhar Date: Thu, 2 Jul 2026 22:51:03 +0530 Subject: [PATCH] update(falco_rules): exclude systemd helpers from Read sensitive file untrusted systemd spawns short-lived helper processes that legitimately read sensitive account and PAM files during normal operation. Because these helpers report a bare-number or comm-truncated proc.name, they cannot be matched by name, so the existing systemd exclusions in the rule do not cover them and the rule fires a false positive on every affected host. This adds a systemd_sensitive_file_readers macro that matches on proc.exepath (kernel-resolved and unspoofable) anchored to the expected systemd parent, covering two observed helpers: - systemd-executor (unit re-exec deserialize handoff) - systemd-userwork (userdb User/Group Record Lookup worker) The systemd-userwork case was reproduced locally on systemd 259 / Falco 0.44.1 and verified by deterministic capture replay. The systemd-executor case is reported in falcosecurity/rules#291 and falcosecurity/falco#3480. Signed-off-by: MayankSekhar --- rules/falco_rules.yaml | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/rules/falco_rules.yaml b/rules/falco_rules.yaml index 40cb8b1d..1e0d427c 100644 --- a/rules/falco_rules.yaml +++ b/rules/falco_rules.yaml @@ -427,10 +427,23 @@ and not linux_bench_reading_etc_shadow and not user_known_read_sensitive_files_activities and not user_read_sensitive_file_containers + and not systemd_sensitive_file_readers output: Sensitive file opened for reading by non-trusted program | file=%fd.name gparent=%proc.aname[2] ggparent=%proc.aname[3] gggparent=%proc.aname[4] evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty priority: WARNING tags: [maturity_stable, host, container, filesystem, mitre_credential_access, T1555] +# systemd spawns short-lived helper processes that legitimately read sensitive +# account/PAM files (e.g. /etc/shadow, /etc/pam.d/*) during normal operation. +# These helpers report a bare-number or comm-truncated proc.name, so they cannot +# be matched by name; proc.exepath (kernel-resolved, unspoofable) is used instead, +# and each entry is anchored to its expected systemd parent to keep it tight. +# - systemd-executor: unit (re)exec deserialize handoff (see falcosecurity/falco#3480) +# - systemd-userwork: userdb (User/Group Record Lookup) query worker +# The rule "Read sensitive file untrusted" uses this macro to avoid FPs. +- macro: systemd_sensitive_file_readers + condition: > + ((proc.pname=systemd and proc.exepath=/usr/lib/systemd/systemd-executor) or + (proc.pname=systemd-userdbd and proc.exepath=/usr/lib/systemd/systemd-userwork)) - macro: postgres_running_wal_e condition: (proc.pname=postgres and (proc.cmdline startswith "sh -c envdir /etc/wal-e.d/env /usr/local/bin/wal-e" or proc.cmdline startswith "sh -c envdir \"/run/etc/wal-e.d/env\" wal-g wal-push"))