feat(lab9): falco custom rules + conftest hardening policies + cryptominer detection

[Meliman1000-7]

Goal

Run Falco with modern eBPF to capture baseline runtime alerts and write a custom detection rule, then implement Conftest/Rego policies that gate Kubernetes manifests at CI time. Bonus: a Falco rule detecting cryptominer process execution by name.

Changes

• labs/lab9/falco/rules/custom-rules.yaml — two custom Falco rules: "Write to /tmp by container" (WARNING) and "Possible Cryptominer Activity" (CRITICAL)
• labs/lab9/manifests/good-pod.yaml — compliant K8s Pod manifest (passes all 4 Conftest rules)
• labs/lab9/manifests/bad-pod-runasroot.yaml — non-compliant manifest (missing runAsNonRoot + allowPrivilegeEscalation=true)
• labs/lab9/manifests/bad-pod-no-resources.yaml — non-compliant manifest (missing memory limits + runAsNonRoot)
• labs/lab9/policies/extra/hardening.rego — 4 Rego v1 deny rules: runAsNonRoot, allowPrivilegeEscalation, capabilities.drop ALL, memory limits
• submissions/lab9.md — full writeup: 2 baseline alerts, custom rule + fired alert, tuning discussion, Conftest outputs, CI-vs-admission analysis, cryptominer bonus

Testing

Falco startup (modern eBPF on Docker Desktop / linuxkit 6.12.76):
docker run -d --name falco --privileged --pid=host --net=host --cgroupns=host ...
→ Opening 'syscall' source with modern BPF probe

Baseline alerts triggered via falcosecurity/event-generator:
docker run --rm --privileged --pid=host falcosecurity/event-generator run syscall --loop=false
→ 16 unique rules fired including "Run shell untrusted" and "Read sensitive file untrusted"

Custom rule "Write to /tmp by container" triggered:
docker exec lab9-target /bin/sh -c 'echo "test" > /tmp/custom-rule-test.txt'
→ {"rule":"Write to /tmp by container","priority":"Warning",...}

Cryptominer rule triggered:
docker exec lab9-target /bin/sh -c 'cp /bin/sh /tmp/xmrig && /tmp/xmrig -c exit'
→ {"rule":"Drop and execute new binary in container","priority":"Critical","proc.name":"xmrig","exe_flags":"EXE_WRITABLE|EXE_UPPER_LAYER"}

Conftest policies:
conftest test labs/lab9/manifests/good-pod.yaml --policy labs/lab9/policies/extra/
→ 4 tests, 4 passed, 0 warnings, 0 failures

conftest test labs/lab9/manifests/bad-pod-runasroot.yaml --policy labs/lab9/policies/extra/
→ FAIL: must set allowPrivilegeEscalation=false, must set runAsNonRoot=true
→ 4 tests, 2 passed, 0 warnings, 2 failures

conftest test labs/lab9/manifests/bad-pod-no-resources.yaml --policy labs/lab9/policies/extra/
→ FAIL: must set resources.limits.memory, must set runAsNonRoot=true
→ 4 tests, 2 passed, 0 warnings, 2 failures

Artifacts & Screenshots

• submissions/lab9.md
• labs/lab9/falco/rules/custom-rules.yaml
• labs/lab9/policies/extra/hardening.rego

Checklist

• Title is clear (feat(labN): style)
• No secrets or large temp files committed (logs not committed)
• Submission file at submissions/lab9.md exists