feat(lab9): falco custom rules + conftest hardening policies

[Maflock]

Goal

Run Falco with modern eBPF, trigger baseline + custom alerts, then write Conftest/Rego policies that gate Kubernetes manifests at CI time. (Bonus) Write a Falco rule that detects a specific attacker pattern.

Changes

• Added labs/lab9/falco/rules/custom-rules.yaml
• Added labs/lab9/policies/extra/hardening.rego
• Added submissions/lab9.md

Testing

# 1. Start Falco with eBPF and custom rules
docker run -d --name falco --privileged \
  -v /proc:/host/proc:ro -v /boot:/host/boot:ro \
  -v /lib/modules:/host/lib/modules:ro -v /usr:/host/usr:ro \
  -v /var/run/docker.sock:/host/var/run/docker.sock \
  -v "$(pwd)/labs/lab9/falco/rules":/etc/falco/rules.d:ro \
  falcosecurity/falco:0.43.1 falco -U -o json_output=true
# Falco started, modern eBPF engine loaded

# 2. Trigger baseline alerts
docker exec lab9-target /bin/sh -c 'echo "shell test"'
docker exec lab9-target cat /etc/shadow
docker exec lab9-target /bin/sh -c 'echo "drift" > /usr/local/bin/drift.txt'
# 3 alerts fired: Terminal shell, Read sensitive file, Write below binary dir

# 3. Trigger custom rule — write to /tmp
docker exec lab9-target /bin/sh -c 'echo "test" > /tmp/my-write.txt'
# Alert: "Write to /tmp by container" — custom rule works

# 4. Run Conftest on hardened manifest
conftest test labs/lab9/manifests/k8s/juice-hardened.yaml \
  --policy labs/lab9/policies/extra/
# 14 tests, 14 passed, 0 failures

# 5. Run Conftest on unhardened manifest
conftest test labs/lab9/manifests/k8s/juice-unhardened.yaml \
  --policy labs/lab9/policies/extra/
# 14 tests, 8 passed, 6 failures — runAsNonRoot, allowPrivEscalation, capabilities, resources

# 6. Trigger cryptominer rule (bonus)
docker exec lab9-target /bin/sh -c 'nc -w 2 127.0.0.1 3333' 2>/dev/null || true
# Alert: "Possible Cryptominer Activity" on port 3333 — rule fires

# 7. Verify all rules loaded
docker logs falco | grep "schema validation"
# custom-rules.yaml: ok, falco_rules.yaml: ok

---

Artifacts & Screenshots

• labs/lab9/falco/rules/custom-rules.yaml
• labs/lab9/policies/extra/hardening.rego
• submissions/lab9.md

Checklist

• Title is clear (feat(lab9): falco custom rules + conftest hardening policies)
• No secrets/large temp files committed
• submissions/lab9.md exists
• Task 1 — 2 baseline + 1 custom Falco alert with tuning discussion
• Task 2 — ≥3 Conftest rules (K8s pass/fail) + shipped compose policy run
• Bonus — Cryptominer detection rule with triggered alert