Create Hardlink Over Sensitive Files

​

Event Information

​

Meaning

• The Create Hardlink Over Sensitive Files event in a Kubernetes cluster indicates that a process attempted to create a hardlink to a sensitive file.
• This event could potentially be a security concern as it may indicate an unauthorized attempt to modify or access sensitive data.
• It is important to investigate the source of this event and take appropriate actions to ensure the integrity and confidentiality of the sensitive files in the cluster.

To investigate further, you can:

• Use kubectl to check the logs of the relevant pod or container to identify the process that triggered the event.
• Inspect the file system permissions and ownership of the sensitive files to ensure they are properly secured.
• Consider implementing file integrity monitoring tools or auditing mechanisms to detect and prevent unauthorized modifications to sensitive files.

​

Remediation

To remediate the event “Create Hardlink Over Sensitive Files” using the Python Kubernetes API, you can follow these steps:

1. Identify the affected pod:

   • Use the event details to determine the pod name and namespace.
   • Run the following command to get the pod details:

     kubectl get pod <pod-name> -n <namespace> -o yaml
     

2. Create a Kubernetes manifest file to update the pod:

   • Modify the YAML file obtained from the previous step to include a securityContext with the appropriate settings to prevent hardlink creation.
   • Add the following section to the pod’s YAML file:

     spec:
       securityContext:
         allowPrivilegeEscalation: false
         readOnlyRootFilesystem: true
     

3. Apply the updated manifest file:

   • Save the modified YAML file.
   • Run the following command to apply the changes to the pod:

     kubectl apply -f <path-to-updated-manifest-file>
     

Note: Make sure you have the necessary permissions to modify the pod and namespace.