Selectors

Selectors are used in various places to scope policies, rules, and actions. Spyderbat's selectors based on Kubernetes Labels and Selectors.

Selector Primitives

Spyderbat's selectors offer set-based selector primitives.

*matchLabels	user-defined key value pairs
*matchExpressions	contain a key, operator, and values
**matchFields	pre-defined key value pairs
**matchFieldsExpressions	key from pre-defined list, operator, and values

• * Matches the syntax from Kubernetes

• ** Unique to Spyderbat's Selectors

Expressions

Expressions have 3 fields: key, operator, and values. They allow you to define set-based groupings.

Example:

matchExpressions:
- key: app
  operator: In
  values: [apache, mysql]

In the example above whatever is being matched on, must have a label with a key app and the value of that label must be either apache or mysql.

Operators

Operators define how the set-based expression is to be evaluated.

In	The key must exist and the value must be in values
NotIn	The key must exists and the value must not be in values
Exists	The key must exist
DoesNotExist	The key must not exist

Pod and Namespace Selectors

Pod and Namespace selectors are defined the exact same way that Kubernetes Pod and Namespace selectors are. Both resources types can have user-defined labels that allow them to be grouped by selectors.

The labels are found within the Pod and Namespace object yaml.

Supported Primitives
matchLabels
matchExpressions

Examples:

podSelector:
  matchLabels:
    app: apache
  matchExpressions:
  - {key: tier, operator: In, values: [frontend, backend]}
  - {key: test, operator: DoesNotExist}

namespaceSelector:
  matchLabels:
    kubernetes.io/metadata.name: production
  matchExpressions:
  - {key: dedicated-node, operator: Exists}

Other Selectors

The following selectors are Custom to Spyderbat's environment. They add an additional level on granularity to scoping operations.

Supported Primitives
matchFields
matchFieldsExpressions

Cluster Selector

The Cluster Selector allows for scoping by Kubernetes Cluster. Field values may be wildcarded with an * character.

Supported Fields	Description
name	The name of the cluster as defined in Spyderbat
uid	The Spyderbat-provided uid of the cluster generally begins with clus:

Example:

clusterSelector:
  matchFields:
    name: demo-cluster

Machine Selector

The Machine Selector allows for scoping my Machine. A machine in this context is a device with the Spyderbat Nano Agent installed.

Supported Fields	Description
hostname	The hostname of a host on the network
uid	The Spyderbat-provided uid of the machine generally begins with mach:

Example:

machineSelector:
  matchFieldsExpressions:
  - {key: hostname, operator: In, values: [test_node, staging_node]}

Container Selector

The Container Selector allows for scoping by fields associated with containers.

Supported Fields	Description
image	The container's image name
imageID	The container's image hash
containerName	The name of a specific container instance (usually auto-generated)
containerID	The ID of a specific container instance (usually auto-generated)

Example:

containerSelector:
  matchFields:
    image: docker.io/apache

Service Selector

The Service Selector allows for scoping by fields associated with Linux Services

Supported Fields	Description
cgroup	The cgroup that every process within the service falls under. Ex. systemd:/system.slice/nano-agent.service
name	The simple name of the Linux service. Ex. nano-agent.service

Example:

serviceSelector:
  matchFields:
    cgroup: systemd:/system.slice/nano-agent.service

Trace Selector

The Trace Selector is used by Trace Suppression Policies to suppress Spydertraces within a specific scope.

Supported Fields	Description
triggerClass	The class of flag that triggered the Spydertrace
triggerAncestors	The names of the ancestor processes of the flag that triggered the Spydertrace

Example:

traceSelector:
  matchFields:
    triggerClass: redflag/proc/command/high_severity/suspicious/netcat

User Selector

The User Selector is used by Trace Suppression Policies to suppress Spydertraces triggered by a specific user or users.

Supported Fields	Description
user	The username of the offending user

Example:

userSelector:
  matchFieldsExpressions:
  - {key: user, operator: NotIn, values: [admin, root]}

Process Selector

The Process Selector is used to scope by fields associated with a Linux Process.

Supported Fields	Description
name	The name of the process
exe	The executable of the process
euser	The username of the process' effective user

processSelector:
  matchFields:
    exe: /bin/bash