disk_mount: don't whitelist runc process (#2659)

instead use the ContainerStarted context flag

Author: roikol

signatures/golang/disk_mount.go

@@ -56,12 +56,16 @@ func (sig *DiskMount) OnEvent(event protocol.Event) error {
 
 	case "security_sb_mount":
 
+		if !eventObj.ContextFlags.ContainerStarted {
+			return nil
+		}
+
 		deviceName, err := helpers.GetTraceeStringArgumentByName(eventObj, "dev_name")
 		if err != nil {
 			return nil
 		}
 
-		if !isRunc(eventObj) && strings.HasPrefix(deviceName, sig.devDir) {
+		if strings.HasPrefix(deviceName, sig.devDir) {
 			metadata, err := sig.GetMetadata()
 			if err != nil {
 				return err
@@ -82,11 +86,3 @@ func (sig *DiskMount) OnSignal(s detect.Signal) error {
 	return nil
 }
 func (sig *DiskMount) Close() {}
-
-func isRunc(event trace.Event) bool {
-	if event.ThreadID == 1 && strings.HasPrefix(event.ProcessName, "runc:") {
-		return true
-	}
-
-	return false
-}

signatures/golang/disk_mount_test.go

@@ -20,9 +20,10 @@ func TestDiskMount(t *testing.T) {
 			Name: "should trigger detection",
 			Events: []trace.Event{
 				{
-					ProcessName: "mal",
-					ThreadID:    8,
-					EventName:   "security_sb_mount",
+					ProcessName:  "mal",
+					ThreadID:     8,
+					ContextFlags: trace.ContextFlags{ContainerStarted: true},
+					EventName:    "security_sb_mount",
 					Args: []trace.Argument{
 						{
 							ArgMeta: trace.ArgMeta{
@@ -37,9 +38,10 @@ func TestDiskMount(t *testing.T) {
 				"TRC-1014": {
 					Data: nil,
 					Event: trace.Event{
-						ProcessName: "mal",
-						ThreadID:    8,
-						EventName:   "security_sb_mount",
+						ProcessName:  "mal",
+						ThreadID:     8,
+						ContextFlags: trace.ContextFlags{ContainerStarted: true},
+						EventName:    "security_sb_mount",
 						Args: []trace.Argument{
 							{
 								ArgMeta: trace.ArgMeta{
@@ -68,12 +70,13 @@ func TestDiskMount(t *testing.T) {
 			},
 		},
 		{
-			Name: "should not trigger detection - runc",
+			Name: "should not trigger detection - container not started",
 			Events: []trace.Event{
 				{
-					ProcessName: "runc:[init]",
-					ThreadID:    1,
-					EventName:   "security_sb_mount",
+					ProcessName:  "runc:[init]",
+					ThreadID:     1,
+					ContextFlags: trace.ContextFlags{ContainerStarted: false},
+					EventName:    "security_sb_mount",
 					Args: []trace.Argument{
 						{
 							ArgMeta: trace.ArgMeta{
@@ -90,9 +93,10 @@ func TestDiskMount(t *testing.T) {
 			Name: "should not trigger detection - wrong path",
 			Events: []trace.Event{
 				{
-					ProcessName: "runc:[init]",
-					ThreadID:    8,
-					EventName:   "security_sb_mount",
+					ProcessName:  "runc:[init]",
+					ThreadID:     8,
+					ContextFlags: trace.ContextFlags{ContainerStarted: true},
+					EventName:    "security_sb_mount",
 					Args: []trace.Argument{
 						{
 							ArgMeta: trace.ArgMeta{