feat(lab9): falco custom rules + conftest hardening policies

[SSSNeka]

Goal

Run Falco with modern eBPF to trigger baseline + custom runtime alerts, then write Conftest/Rego policies that gate Kubernetes manifests at CI time — per Lab 9.

Changes

• Ran Falco 0.43.1 with the modern eBPF probe against a WSL2 kernel with BTF support (docker run --rm --privileged alpine test -f /sys/kernel/btf/vmlinux confirmed before starting).
• Triggered 2 baseline alerts on lab9-target (alpine): Terminal shell in container and Read sensitive file untrusted (cat /etc/shadow).
• Wrote a custom rule (labs/lab9/falco/rules/custom-rules.yaml) — "Write to /tmp by container" — and confirmed it fires via SIGHUP rule-reload + a live trigger.
• Wrote labs/lab9/policies/extra/hardening.rego (Conftest, package main) with 5 deny rules: runAsNonRoot, allowPrivilegeEscalation, capabilities.drop: ["ALL"], resources.limits.memory, and sha256-digest pinning.
• Verified the policy: 0 failures on juice-hardened.yaml, 5 distinct failures on juice-unhardened.yaml.
• Ran the shipped compose-security.rego (--namespace compose.security) against the provided hardened compose file (PASS) and a deliberately unhardened one (FAIL) to show the same deny[msg] pattern generalizing to input.services.
• Fixed and documented a real Rego gotcha along the way: not "ALL" in <possibly-missing-path> silently never fires when the path is fully undefined (undefined propagation), guarded with object.get(..., []) in my policy — the shipped compose policy has the same gap, which is why only 2 of 3 possible denies fire on the bad-compose test.

Testing

• docker logs falco — confirms Opening 'syscall' source with modern BPF probe.
• Both baseline Falco alerts captured as JSON in submissions/lab9.md.
• Custom Falco rule fired on echo test > /tmp/my-write.txt — JSON alert captured.
• conftest test .../juice-hardened.yaml --policy labs/lab9/policies/extra/ → 10 tests, 10 passed, 0 failures.
• conftest test .../juice-unhardened.yaml --policy labs/lab9/policies/extra/ → 10 tests, 5 passed, 5 failures.
• conftest test .../juice-compose.yml --policy .../compose-security.rego --namespace compose.security → 4 tests, 4 passed, 0 failures.
• Same against a deliberately unhardened compose file → 4 tests, 2 passed, 2 failures.

Artifacts & Screenshots

See submissions/lab9.md for full JSON alert dumps, the policy source, and all Conftest output.

Checklist

• Title is clear (feat(lab9): falco custom rules + conftest hardening policies)
• No secrets/large temp files committed (labs/lab9/falco/logs/ excluded — only rule/policy files and the submission write-up committed)
• Submission file at submissions/lab9.md exists

---

• Task 1 — 2 baseline + 1 custom Falco alert with tuning discussion
• Task 2 — ≥3 Conftest rules (K8s pass/fail) + shipped compose policy run
• Bonus — Cryptominer detection rule with triggered alert