Detect call of program with SUID or SGID flags set

[rpasche]

HI community,

we are running falco 0.40 within our k8s clusters using modern_ebpf. We added a rule to detect the setting of SUID or SGID permissions onto files. This works.

What we would also like is to detect such "privilege escalation" by calling a program having SUID or SGID set.

Our main problem is, that our processes running within the container do not have the loginuid set in /proc/<pid>/loginuid. This is set to 4294967295 which is -1 as UINT. As a result, a rule trying to compare user.uid and user.loginuid does not really work.

See also https://stackoverflow.com/questions/22914627/some-uids-in-proc-pid-loginuid-are-strange

Do you have an idea, how this can be solved?

Thanks.