no telemetry for host mount FS events

[rksharma95]

Bug Report

General Information

• Environment description (GKE, VM-Kubeadm, vagrant-dev-env, minikube, microk8s, ...)

  digitalocean managed cluster (reproducible on k3s as well)
  

• Kernel version (run uname -a)

  6.1.0-21-amd64, Debian GNU/Linux 12 (bookworm), linux
  

• Orchestration system version in use (e.g. kubectl version, ...)

  Client Version: v1.29.1+k3s1
  Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
  Server Version: v1.30.1
  

• Link to relevant artifacts (policies, deployments scripts, ...)
• Target containers/pods

To Reproduce

make sure that file visibility is enabled for test namespace or global default

Ref: https://github.com/kubearmor/KubeArmor/blob/main/getting-started/kubearmor_visibility.md

1. deploy nginx with host FS mount

apiVersion: apps/v1
kind: Deployment
metadata:
  labels:
    app: nginx
  name: nginx
spec:
  replicas: 1
  selector:
    matchLabels:
      app: nginx
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - image: nginx
        imagePullPolicy: Always
        name: nginx
        volumeMounts:
        - mountPath: /sys/kernel/security
          name: sys-kernel-security-path
      volumes:
      - hostPath:
          path: /sys/kernel/security
          type: Directory
        name: sys-kernel-security-path

2. create ksp

apiVersion: security.kubearmor.com/v1
kind: KubeArmorPolicy
metadata:
  name: ksp-block-host-mount
spec:
  action: Block
  file:
    matchDirectories:
    - dir: /tmp/
      recursive: true
    - dir: /sys/kernel/
      recursive: true
  selector:
    matchLabels:
      app: nginx

3. watch for kubearmor alerts in a separate terminal

karmor logs

4. simulate policy violation

POD=$(kubectl get pod -l app=nginx -o name ) \
kubectl exec -it $POD -- bash -c 'cat /sys/kernel/security/lsm'

Expected behavior

1. an alert should be generated by the kubearmor with Operation: File and Resource: /sys/kernel/security/lsm
2. with no policy enforced, system logs should be generated for FS access events to /sys/kernel/security/lsm file