Falco low stable other

Container Access to Host Sensitive Paths

Detects container processes accessing paths that typically only exist when the host filesystem is mounted into the container (like /host, /rootfs, /hostfs). This may indicate a container escape attempt or a misconfigured volume mount that exposes the host filesystem. Legitimate monitoring or backup containers may access these paths, so tune accordingly using the user_known_host_path_access macro.

View Source

Detection Logic

(open_read or open_write) and container and (fd.name startswith /host/ or
     fd.name startswith /rootfs/ or
     fd.name startswith /hostfs/)
and not known_container_runtime_host_access and not user_known_host_path_access

Field Validations

Loading…

Comments (0)

Loading comments...